CVE-2026-104935 (CVSS 8.6): Ivanti Connect Secure Zero-Day Chains to Root — UTA0576 Steals AD Credentials, LAPS Passwords and BitLocker Keys

A three-bug zero-day chain has handed threat actor UTA0576 root-level access on fully patched Ivanti Connect Secure VPN appliances — and what they grabbed once inside is even more alarming: Active Directory credential databases, Local Administrator Password Solution (LAPS) secrets, and BitLocker recovery keys. CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog on October 13, 2026, and federal civilian agencies face a patch deadline of October 16. For every enterprise that trusts Ivanti for remote-access security — and there are thousands of them across India — this is not a drill.

What Happened — and Why It Matters Right Now

Ivanti Connect Secure (ICS) is one of the world’s most widely deployed enterprise VPN and zero-trust network access (ZTNA) platforms. Hundreds of organisations across India — from financial services firms in Mumbai to IT-services companies in Bengaluru and government-adjacent contractors in Delhi NCR — rely on it to securely extend their networks to remote workers, branch offices, and third-party vendors.

On October 13, 2026, Ivanti simultaneously disclosed CVE-2026-104935 and released patches. That same day, CISA issued an urgent advisory and placed the CVE in its Known Exploited Vulnerabilities catalog — a designation reserved for flaws with confirmed in-the-wild exploitation. The problem? Exploitation had been underway since at least October 1, giving attackers a two-week head start on every unpatched deployment in the world.

Volexity, the threat-intelligence firm that discovered the campaign, attributed the intrusions to a cluster it calls UTA0576. This actor operated with disciplined stealth: rather than planting a persistent backdoor, they re-executed their exploit chain for each individual command, returning output via encrypted HTTPS callbacks. Log files were systematically deleted after each session. The goal was to leave defenders with no forensic trail to follow.

Technical Breakdown: How a Three-Bug Chain Hands Attackers Root

CVE-2026-104935 is officially categorised as an authentication bypass combined with a file-write vulnerability affecting the web component of Ivanti Connect Secure. But the picture is more complex than a single CVE number suggests.

Volexity’s research identified a chain of three distinct zero-days that together enable a remote, unauthenticated attacker to execute arbitrary commands with root privileges on a fully-updated appliance:

1. Stage 1 — Authentication bypass: An unauthenticated attacker sends a specially crafted request to the ICS web interface, circumventing the platform’s authentication checks entirely. No credentials are required.
2. Stage 2 — Arbitrary file write: With the authentication gate bypassed, the attacker writes a crafted file to a location the ICS service trusts. This second bug is bundled with the first under the CVE-2026-104935 identifier.
3. Stage 3 — Privilege escalation to root: A separate local privilege-escalation vulnerability elevates the attacker’s foothold to root. Ivanti has acknowledged this third flaw; a patch is expected in the coming weeks but was not available as of October 13, 2026.

The operational technique is particularly sophisticated. UTA0576 executed the chain once per command — effectively running a fresh exploit for every action rather than maintaining a persistent shell. This approach defeats endpoint-detection tools that look for long-lived anomalous processes and reduces the risk that a defender spotting one session can trace it back to a persistent implant.

Honeypot data published by Previdian Security logged 105 distinct exploit attempts targeting CVE-2026-104935 as of October 14, 2026, confirming that the attack technique is now spreading beyond the initial UTA0576 cluster.

Affected ICS Version Branch	Last Vulnerable Version	Fixed Version
22.8 branch	22.8R2.4 and prior	22.8R2.5
25.1.1 branch	25.1.1.1 and prior	25.1.1.2
25.1.2 branch	25.1.2.2 and prior	25.1.3.0 / 25.1.3.1

The Trophy: LAPS Passwords, BitLocker Keys, and AD Credentials

Why does root access on a VPN appliance translate into such catastrophic credential theft? Because VPN concentrators sit at the precise intersection of network perimeter and identity infrastructure. To authenticate users, they must communicate with — and often cache — Active Directory. UTA0576 understood this perfectly.

Volexity’s investigation documented the attacker deploying custom Python tools and Kerberos utilities to:

• Exfiltrate Active Directory credential databases, including password hashes that can be cracked offline.
• Harvest LAPS (Local Administrator Password Solution) secrets — the automatically rotated local administrator passwords stored in AD. With these, an attacker can authenticate as a local admin on every Windows endpoint in the domain, bypassing domain credentials entirely.
• Retrieve BitLocker recovery keys stored in Active Directory. These 48-character keys decrypt the full-disk encryption protecting Windows laptops and servers — meaning a stolen laptop or seized server becomes an open book.
• Conduct LDAP traffic interception and password-spraying against domain accounts.
• Review authentication logs to identify high-value accounts and understand the victim’s security monitoring posture.

In practical terms: after a successful UTA0576 intrusion, an enterprise faces potential compromise of every managed Windows device and every AD-backed service — not just the VPN appliance. This is a full-domain breach delivered through a single internet-exposed gateway.

What You Should Do — Sanjay Seth’s Expert Perspective

After three decades of securing enterprise networks — including some of India’s largest campus deployments — I’ve seen this pattern many times: a perimeter device trusted implicitly, an attacker who exploits that trust, and a response team that discovers too late that the blast radius extends far beyond the initial foothold.

Here is a prioritised response checklist for any organisation running Ivanti Connect Secure:

1. Patch immediately. Apply the fixed versions listed above. If you cannot patch within 24 hours, isolate the appliance from direct internet exposure and route traffic through a WAF or application proxy.
2. Assume compromise on any unpatched appliance that was internet-exposed between October 1 and now. Per CISA’s advisory, do not simply patch and continue — perform a factory reset and restore from a known-clean backup.
3. Rotate all credentials and certificates issued through or stored on ICS appliances. This includes: service account passwords, VPN certificates, any secrets or API keys the appliance may have cached.
4. Rotate LAPS passwords and BitLocker recovery keys across your entire domain if you cannot confirm the appliance was uncompromised during the exposure window.
5. Check for log-deletion evidence. The absence of logs on a normally verbose ICS appliance is itself a strong indicator of UTA0576 activity. Use SIEM correlation to identify gaps in authentication log sequences.
6. Hunt for custom Python processes and Kerberos tool artefacts on the appliance filesystem and on any DCs the appliance communicated with.
7. Review your zero-trust architecture. If a VPN appliance breach can cascade to full AD compromise, your segmentation is insufficient. The VPN gateway should authenticate users — it should not hold the keys to your entire identity infrastructure. Consider whether moving to a hardware-separated zero-trust design using FortiGate and FortiAuthenticator makes sense for your organisation.
8. Review all your edge-device patch posture. This incident is part of a broader trend of VPN and gateway vulnerabilities — we’ve recently covered critical zero-days in Cisco Catalyst SD-WAN Manager that follow the same perimeter-first attack pattern. A formal edge-device vulnerability management programme is no longer optional.

Indian enterprises have an additional consideration: the CERT-In Cybersecurity Incident Reporting rules require disclosure of security incidents within six hours of detection for critical-sector organisations. If you discover evidence of UTA0576 activity, your incident response team must simultaneously manage technical remediation and regulatory notification. Start the clock the moment you find the first indicator of compromise.

Frequently Asked Questions

Is this vulnerability exploitable without any credentials at all?

Yes. CVE-2026-104935 is an authentication bypass — Stage 1 of the attack chain requires no username or password. An attacker with network access to your ICS appliance’s web interface can initiate the exploit chain without any prior access to your environment. This is what makes this vulnerability particularly severe, despite its CVSS score of 8.6.

Our ICS appliance was fully patched before October 13. Are we safe?

No. Exploitation was confirmed as early as October 1, and the patches were released on October 13. If your appliance was internet-exposed at any point between October 1 and October 13 running a vulnerable version (which includes all versions prior to those listed in the patch table above), you should treat it as potentially compromised and follow CISA’s guidance: factory reset, restore from clean backup, rotate all credentials.

How do I check whether UTA0576 has been active on my appliance?

Volexity identified several indicators: (a) missing or truncated authentication logs covering the October 1–13 period — UTA0576 deleted logs after each session; (b) unexpected Python interpreter processes or Kerberos utility artefacts on the appliance; (c) LDAP query bursts from the appliance’s IP to domain controllers; (d) anomalous HTTPS callbacks to external IPs from the appliance during off-hours. Cross-reference your SIEM logs against these patterns and engage a threat-intelligence partner if you find gaps you cannot explain.

Should Indian organisations wait for CERT-In’s advisory before acting?

No — act on the CISA advisory and Ivanti’s security bulletin now. CERT-In tracks and re-publishes major CVEs, but its advisories may lag by 24–72 hours. Given that exploitation in the wild began on October 1 and 105 active exploit attempts were recorded by October 14, every hour of delay increases your exposure. Patch, assess for compromise, and notify CERT-In if you find evidence of an intrusion.

The Bigger Picture: VPN Devices Are a Primary Target — and Zero Trust Is the Answer

CVE-2026-104935 is the latest in a relentless series of critical flaws in internet-exposed VPN and remote-access appliances. The Hacker News notes that Ivanti Connect Secure has now been at the centre of three major nation-state-grade exploitation campaigns in two years. The pattern is consistent: these devices are valuable because they sit at the boundary of internal networks, hold high-privilege credentials, and are difficult to monitor from the inside.

The strategic lesson is not to swap one VPN vendor for another. It is to architect your environment so that no single internet-exposed gateway holds the keys to your identity infrastructure. A genuine zero-trust design — one where the VPN gateway authenticates through an identity provider rather than holding credentials itself, where lateral movement requires continuous re-verification, and where AD secrets are protected by additional segmentation — limits the blast radius of exactly this type of compromise.

At P J Networks, we help Indian enterprises architect, deploy, and validate zero-trust environments — from segmented campus networks to cloud-native ZTNA designs. If CVE-2026-104935 has raised questions about your current VPN and remote-access architecture, reach out for a security architecture assessment. The time to review your perimeter assumptions is before the next exploit chain, not after.

Sources: CISA Advisory (Oct 13, 2026) · BleepingComputer · The Hacker News · Security Online