Search — “CVE-2026-118527”

Ivanti Connect Secure gateways were compromised via two zero-days chained with the authentication bypass CVE-2026-104935, with exploitation reported since at least October 1, 2026, per Volexity and Defused as cited by BleepingComputer. Volexity attributes the activity to UTA0576, which gained unauthenticated root-level code execution, deployed no malware or web shell, re-exploited the device for each command, and tampered with logs. Hunters should look for anomalous ICS behavior and log tampering rather than relying on a clean Integrity Checker Tool result.