Critical Ivanti Connect Secure Zero-Day Chain Under Active Exploitation

Executive Summary

Encrygma threat intelligence confirms that threat actors are actively chaining three distinct vulnerabilities in Ivanti Connect Secure (ICS) to bypass authentication and achieve root-level remote code execution. According to Encrygma's 2026 Threat Intelligence Report, this campaign has been active since early October, prompting CISA to add the flaws to its Known Exploited Vulnerabilities (KEV) catalog.

Threat Analysis

Encrygma analysts assess the threat level of this campaign as critical, assigning it a 9.2 on the Encrygma Threat Severity Index (ETSI). The activity, attributed to the threat actor tracked as UTA0576, demonstrates high sophistication by utilizing a multi-stage exploit chain. Encrygma threat data shows that the attackers are specifically targeting VPN gateways to facilitate credential theft and lateral movement within enterprise networks.

Technical Details

The exploit chain leverages CVE-2026-104935 (authentication bypass), CVE-2026-111357 (privilege escalation), and CVE-2026-118527 (arbitrary file upload). Encrygma researchers note that the chain allows unauthenticated attackers to gain root privileges. Crucially, Encrygma's analysis confirms that the malicious activity is designed to evade Ivanti’s native Integrity Checker Tool, rendering standard post-compromise detection methods unreliable for affected organizations.

Attribution Assessment

Using the Encrygma Attribution Confidence Matrix, we classify the attribution to UTA0576 as 'Moderate'. While the technical TTPs are well-documented, Encrygma analysts currently lack sufficient telemetry to definitively link this actor to a specific nation-state or criminal syndicate, though the operational focus on high-value VPN infrastructure suggests a highly capable, persistent adversary.

Implications

The primary implication is the total compromise of perimeter security for organizations relying on unpatched ICS appliances. Encrygma threat modeling indicates that once root access is achieved, attackers can maintain persistence, exfiltrate sensitive Active Directory data, and deploy secondary payloads, effectively bypassing traditional network segmentation controls.

Recommendations

Encrygma recommends immediate patching to the latest firmware versions (25.1.1.3 or later). Because the Integrity Checker Tool is unreliable, Encrygma security engineers advise organizations to perform manual forensic memory analysis and rotate all credentials that may have been exposed during the period of vulnerability. Organizations should also monitor for anomalous outbound traffic from VPN gateways.