Ivanti adds two more Connect Secure flaws to an exploited chain
Ivanti updated its advisory on October 29 to add a privilege escalation bug and a file upload bug, both now fixed and both in CISA's KEV list. Volexity says the chain was used against an appliance from October 3.
Ivanti updated its Connect Secure advisory on October 29, 2026 to add two vulnerabilities and released fixes for both. One is a missing authentication for critical function bug that lets a local authenticated attacker escalate privileges, rated 8.8 by Ivanti. The other is a predictable numbers or identifiers flaw, rated 4.3, that CISA's KEV entry says lets a remote authenticated attacker upload attacker-controlled content to a known location on disk.
Per Ivanti, both were exploited in the wild before disclosure, affecting a limited number of customers when chained with the earlier authentication bypass. CISA added the two to its KEV list on October 30.
Volexity's investigation attributes the activity to UTA0576, which it says used an exploit chain to get unauthenticated root on an appliance running 22.8R2.4, starting October 3, 2026. Volexity saw credential theft and Active Directory queries for Windows LAPS passwords and BitLocker recovery keys.
Rapid7's write-up notes the October 13 fixes in 25.1.1.2 and 22.8R2.5 don't cover the two new flaws; 25.1.1.3 and 22.8R2.6 do. It also warns the observed activity evades Ivanti's Integrity Checker Tool, so a clean result doesn't rule out compromise. Preserve memory and logs before rebooting where you can.
We'd treat any ICS box that was internet-facing in early October as suspect until someone has looked at it, not just patched.
CVE references
Sources
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning