View Ridge Security
Back to Cyber Hose

UTA0576 chains Ivanti zero-days for unauthenticated root on patched

Threat actor UTA0576 exploits Ivanti Connect Secure zero-days for root on patched VPNs, plus Apple spyware alerts in 99 countries and a TeamViewer RCE fix.

🚨 ACTIVE EXPLOITATION

  • UTA0576 chains Ivanti Connect Secure zero-days for unauthenticated root access on patched VPNs CVE-2026-111357 CVE-2026-118527
    Unknown threat actor UTA0576 chained three Ivanti Connect Secure zero-day vulnerabilities to achieve unauthenticated root code execution on fully patched VPN appliances.
    • Applies to Ivanti Connect Secure VPN appliances; affected versions include 22.8R2.4 and earlier, 25.1.1.1 and earlier, and 25.1.2.2 and earlier; over 5,500 internet-accessible ICS instances reported.
    • The chain combines an authentication bypass and RCE (CVE-2026-104935, CVSS 8.6) with a privilege escalation flaw (CVE-2026-111357) to gain unauthenticated root code execution.
    • Exploitation starts with an authentication bypass in welcome.cgi using an X-DSCGI-PATH header to reach protected scripts, followed by a file-upload race condition in wu.cgi to execute uploaded Perl scripts.
    • The privilege escalation exploits the dsinvoked broker trusting DSCache configuration data; it was unpatched until Ivanti's October 29, 2026 patch for CVE-2026-111357.
    • UTA0576 stole Active Directory credentials, LAPS passwords, and BitLocker recovery keys, deleted log evidence, and used no backdoor or web shell — commands ran via the exploit chain's HTTPS requests, so Ivanti's Integrity Checker Tool may not detect compromise.
    Sources 📄 Source: hub.ivanti.com · 📎 Coverage: nvd.nist.gov · 👁 via CISA KEV (+1)

💥 BREACHES & INCIDENTS

  • Defense contractor with top secret clearance pleads guilty to aiding North Korean remote worker scheme
    A 62-year-old US defense contractor pleaded guilty to letting North Korean co-conspirators use his identity and top secret clearance to apply for remote IT jobs.
    • John Allen Kurrle Jr., 62, allowed co-conspirators to use his identity and top secret security clearance to apply for jobs at US companies, including roles with national security implications.
    • The conspiracy spanned at least 88 job applications at US-based companies, resulting in nine job offers between June and October 2025 with salaries of $120,000-$190,000.
    • Kurrle hosted laptops shipped by victim companies at his Gainesville, Virginia residence, enabling overseas operatives to remotely access corporate devices via a laptop farm.
    • One co-conspirator was hired as a software engineer on a generative AI project for a US military component but was terminated after a video verification call revealed a mismatch with Kurrle's age and appearance.
    • Kurrle pleaded guilty to conspiracy to commit wire fraud, faces up to 20 years, and is ordered to pay about $7,000 in restitution; the broader scheme generates hundreds of millions annually for North Korea's weapons programs.
    Sources 📄 Source: justice.gov · 📎 Coverage: cyberscoop.com · 👁 via CyberScoop

🔓 CVEs & KEV

  • CVE-2026-119978 — FlowiseAI Flowise — CVSS 9.0 — Flowise through 3.1.4 Custom Function Sandbox Escape RCE via LocalFileStoreFl...

  • CVE-2026-105894 — akbilisim Ak Framework — CVSS 8.8 — Ak Framework through 2.9.8 - Authenticated (Subscriber+) Missing Authorization to ...

  • CVE-2026-115346 — ThemeFusion Avada | Website Builder For WordPress & WooCommerce — CVSS 8.1 — Avada | Website Builder For WordPress & WooCommerce through 7.16.2 - Unauthenticat...

  • CVE-2026-76012 — smub Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery — CVSS 7.5 — Photo Gallery, Sliders, Proofing and Themes through 4.4.1 - Authenticated (Custom+...

  • CVE-2026-118205 — wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets — CVSS 7.4 — Essential Addons for Elementor through 6.8.7 - Unauthenticated Privilege Escalatio...

  • CVE-2026-104744 — Independent Analytics Pro — CVSS 7.2 — Independent Analytics Pro through 2.15.5 - Unauthenticated Stored Cross-Site Scrip...

  • CVE-2026-112365 — wpdevteam easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution — CVSS 7.2 — easy.jobs through 2.8.4 - Unauthenticated Stored Cross-Site Scripting via 'cover_l...

  • CVE-2026-115820 — ahmadmj Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin — CVSS 6.5 — Majestic Support through 1.2.2 - Authenticated (Subscriber+) SQL Injection via 'co...

  • CVE-2026-102905 — spacetime Ad Inserter – Ad Manager & AdSense Ads — CVSS 6.5 — Ad Inserter through 2.8.19 - Unauthenticated Arbitrary Shortcode Execution via 's'...

  • CVE-2026-119113 — paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory — CVSS 6.4 — GeoDirectory through 2.8.199 - Authenticated (Subscriber+) Stored Cross-Site Scrip...

  • CVE-2026-115869 — themifyme Themify Builder — CVSS 6.4 — Themify Builder through 7.8.4 - Authenticated (Contributor+) Stored Cross-Site Scr...

  • CVE-2026-102918 — davidanderson Redux Framework — CVSS 6.4 — Redux Framework through 4.5.15 - Authenticated (Subscriber+) Stored Cross-Site Scr...

🕵️ RESEARCH & DEEP DIVES

  • Apple sends mercenary spyware threat notifications to users in 99 countries
    Apple has sent a new batch of threat notifications warning users in 99 countries that they were likely targeted with mercenary spyware.

    • Applies to iPhone, iPad, and Mac users, typically journalists, activists, politicians, and diplomats targeted because of who they are or what they do.
    • Apple's threat notifications are high-confidence alerts of individually targeted mercenary spyware attacks, such as NSO Group's Pegasus, though Apple does not attribute them to specific attackers.
    • Notifications are delivered as an iPhone Lock Screen push notification, an email from threat-notifications@email.apple.com, and a banner at account.apple.com; genuine alerts never ask users to click links or provide passwords.
    • The latest batch comes shortly before final negotiations on voluntary industry guidelines under the Pall Mall Process for commercial hacking tools.
    • Apple has notified users in over 150 countries since 2021 and recommends Lockdown Mode and Access Now's Digital Security Helpline to notified users.
    Sources 📄 Source: support.apple.com · 📎 Coverage: cyberscoop.com · 👁 via CyberScoop

  • North Korea's DeceptiveDevelopment steals developer credentials to poison GitHub repos and packages
    North Korea-aligned DeceptiveDevelopment has shifted from fake job interviews to stealing developer credentials and injecting malware into trusted repositories and package ecosystems.

    • Targets software developers and downstream users of packages on npm, the Go module mirror, Packagist, PyPI, and browser extension marketplaces.
    • Attackers steal Git credentials, SSH keys, and access tokens to add malicious code to victims' own public and private repositories, often rewriting commit history to hide changes.
    • Delivery starts with fake recruiting/coding-challenge lures; payloads include OmniStealer (Python infostealer) and DEV#POPPER (Node.js RAT persisting in VS Code, Cursor, and Discord).
    • Uses a NullReceiver blockchain-based C2 lookup that reads the server IP from an Ethereum transaction recipient address, making takedown difficult; first case found built into a GitHub-hosted project.
    • Lures and payloads are hosted on hard-to-remove services: Gitea, JSONBin.io, JSONHosting, and Pinata (IPFS gateway), per ESET's APT Activity Report covering April–September 2026.
    Sources 📄 Source: welivesecurity.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)

📋 ADVISORIES

  • TeamViewer fixes host-to-viewer flaw (CVE-2026-111585) letting compromised hosts attack connecting viewers
    TeamViewer has fixed a flaw that lets a malicious or compromised host attack the viewer computer that connects to control it.
    • Affects TeamViewer Full Client on Windows, Linux, and macOS, the Windows Portable edition, and the Android Remote Control app, all versions before 15.83
    • Tracked as CVE-2026-111585, scored 8.8 (High); a malicious host can crash the viewer's TeamViewer and, depending on platform, run code on the viewer
    • Attack works via a screen-size memory allocation overflow: the viewer reserves too little memory and incoming screen data is written out of bounds; no password or extra clicks needed beyond accepting the session
    • Remedio researcher Omri Dar demonstrated code execution on Windows, bypassing built-in exploit defenses; the demo used a stand-in on the host to supply part of the attack data
    • Fixed in TeamViewer 15.83; no known exploitation in the wild and no workaround listed
    Sources 📄 Source: remedio.io · 📎 Coverage: thehackernews.com · 👁 via The Hacker News

📋 ADVISORIES

  • 📄 Source for Rapid7 details unauthenticated file upload to RCE in BeyondTrust Remote Support (CVE-2026-102764) — beyondtrust.com

  • 📄 Source for *

Need help assessing your exposure?

Start with the free Posture Self-Check to see where you stand against the current threat landscape.

Free Posture Self-Check