Attack activity affecting Ivanti Connect Secure highlights the need to investigate credential exposure alongside device compromise. According to The Hacker News, UTA0576 was observed collecting credentials and some Active Directory metadata, conducting server reconnaissance, and searching for administrator passwords and BitLocker recovery keys. Searching for recovery keys does not establish that the attacker obtained them.

CISA added vulnerabilities affecting Ivanti Connect Secure to its Known Exploited Vulnerabilities catalog after exploitation was observed. These include CVE-2026-111357, rated CVSS 8.8: missing authentication for a critical function can allow an authenticated local attacker to elevate privileges. That authenticated local prerequisite remains relevant when assessing the vulnerability individually.

At the attack-chain level, Volexity observed the vulnerabilities being combined with the authentication bypass CVE-2026-104935, used by UTA0576. TMGS therefore recommends assessing how exploitation steps connect when setting remediation priorities. According to the report, Ivanti’s latest release addresses all the vulnerabilities chained and exploited in the observed activity. Updating still needs to be accompanied by an assessment of possible compromise before remediation.

TMGS recommendations

  • Apply the corrective release following vendor guidance, and verify the update on every managed device in scope.
  • Preserve available logs and correlate appliance activity with authentication and administrative activity in the associated environment.
  • Identify accounts and secrets that may have been accessible. Change credentials and revoke sessions according to the investigation’s scope. Review access to BitLocker recovery keys and replace them through established administration procedures if exposure risk is identified.
  • Include contractor accounts with relevant administrative privileges. Establish who retains logs, changes passwords, and revokes access.

TMGS recommends treating both patch status and the credential exposure assessment as completion criteria. Record gaps in evidence rather than treating a successful update as proof that all access remains secure.

Read the full analysis on TMGS: https://tmgs.vn/tin-tuc/ivanti-connect-secure-va-bai-toan-lo-thong-tin-xac-thuc-i.0779cb44-3a0a-41e5-9636-a9b3cd615077