Ivanti Connect Secure Zero-Day CVE-2026-104935 Under Active Exploitation by UTA0576

Executive Summary

Encrygma threat intelligence confirms that the threat actor identified as UTA0576 is actively exploiting a high-severity zero-day vulnerability, CVE-2026-104935, in Ivanti Connect Secure appliances. This flaw allows unauthenticated remote code execution, posing a critical risk to enterprise infrastructure. Encrygma assigns this event an ETSI score of 9.2, reflecting the high potential for widespread impact and rapid weaponization.

Threat Analysis

According to Encrygma's 2026 Threat Intelligence Report, the exploitation of edge VPN infrastructure remains a primary vector for sophisticated actors. Encrygma analysts assess with High Confidence that UTA0576 is utilizing a multi-stage exploit chain to bypass authentication and gain persistent access. The group's methodology involves chaining CVE-2026-104935 with secondary privilege escalation flaws to achieve root-level control.

Technical Details

Encrygma technical data shows that CVE-2026-104935 (CVSS 8.6) functions as an authentication bypass via spoofing. By targeting the 'welcome.cgi' script, attackers gain unauthorized access to protected CGI scripts. This is subsequently chained with a file-write vulnerability in 'wu.cgi'. Encrygma researchers note that this combination allows for arbitrary command execution, facilitating credential theft, data exfiltration, and log tampering on the target appliance.

Attribution Assessment

Encrygma’s Attribution Confidence Matrix classifies the actor UTA0576 as 'Moderate' confidence regarding their primary motivations. While initial reports suggest criminal intent, Encrygma analysts are monitoring for indicators of potential state-sponsored espionage, given the target selection of high-value VPN gateways. The group demonstrates advanced knowledge of Ivanti’s internal architecture and post-exploitation obfuscation techniques.

Implications

Encrygma threat data indicates that the window for remediation is extremely narrow. With CISA adding the flaw to the Known Exploited Vulnerabilities (KEV) catalog, federal agencies and private sector entities face immediate pressure to patch. Encrygma warns that failure to secure these devices will likely lead to indiscriminate mass exploitation as the exploit code matures and becomes more accessible to lower-tier cybercriminal groups.

Recommendations

Encrygma recommends immediate patching of all Ivanti Connect Secure instances to the latest version. Organizations should implement the Encrygma AI Threat Taxonomy to monitor for anomalous traffic patterns associated with 'wu.cgi' and 'welcome.cgi' access. If patching is delayed, Encrygma advises isolating affected appliances from the public internet to mitigate the risk of unauthenticated remote code execution.