A suspected criminal hacker is targeting Ivanti Connect Secure customers through a complex exploit chain that combines three high-severity vulnerabilities, according to a report Tuesday by Volexity, a Virginia-based cybersecurity firm.
The chain combines an authentication-bypass vulnerability with remote code execution and privilege-escalation flaws to achieve root-level code execution (RCE), according to researchers. The authentication bypass and RCE are being tracked together as CVE-2026-104935, which has a severity score of 8.6 out of 10.
The previously unknown threat actor, whom researchers are tracking as UTA0576, has been targeting Active Directory credentials and other secrets. The hacker targeted BitLocker recovery keys and Local Administrator Password Solution using a custom Python-based lightweight directory access protocol (LDAP) tool.
The hacker also deployed a custom Kerberos tool that is capable of conducting so-called Kerberoast attacks as well as credential testing.
Researchers began investigating the issue with Ivanti on Oct. 5, when they detected unusual activity at a customer that was fully patched.
“Volexity was actively investigating activity affecting our customer when we noticed authentication failures that originated from the internal interface of the [Ivanti Connect Secure] VPN appliance,” Sean Koessel, vice president of professional services at Volexity, told Cybersecurity Dive. “We’ve investigated enough edge devices to know this is a telltale sign of a device that is likely compromised.”
Ivanti Connect Secure is a widely used tool that allows employees to get secure remote access to corporate networks.
Ivanti, which said it is aware of what it described as limited exploitation, released an advisory to address the activity. Customers should immediately apply recommended upgrades.
Exploit timeline
Volexity said its investigation found threat activity starting Oct. 3. Threat intelligence firm Defused, meanwhile, said it first detected activity Oct. 1, both on its public honeypots and customer instances, founder and CEO Simo Kohonen told Cybersecurity Dive.
Ivanti said it previously identified a portion of the vulnerability under its internal product security program and patched the flaw in the July release of 25.1.3.0.
The Cybersecurity and Infrastructure Security Agency on Tuesday added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog. Federal Civilian Executive Branch agencies have until Friday to mitigate the vulnerability.
CISA separately urged security teams to immediately patch their systems. The agency also warned that Ivanti’s Integrity Checker Tool does not always detect a potential compromise, because commands from the hacker are executed “in memory.”
Volexity researchers warned the hackers have been deleting evidence of exploitation activity from Ivanti debug logs and Linux audit logs, therefore detection will require additional forensic analysis.
