highlivepartial fix
day · Oct 3, 2026
Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root
› Ivanti Connect Secure (ICS)
Get an email when a new major security incident drops. No spam, unsubscribe any time.
Updates on Oct 3, 2026
Volexity sees UTA0576 chaining for unauth root.
Volexity: UTA0576 chains the auth bypass + RCE (CVE-2026-104935) with a still-unpatched privilege escalation for root.
source
## summary
Volexity observed threat actor UTA0576 chaining an Ivanti Connect Secure authentication-bypass / RCE zero-day (CVE-2026-104935) with additional flaws from about Oct 1–3 2026 to get unauthenticated root on fully patched appliances, re-exploiting in memory without planting webshells. Ivanti patched CVE-2026-104935 on Oct 13; CISA added it to KEV. One privilege-escalation piece of the chain was still being fixed at disclosure.
read the full incident →
