What is the Attack? FortiGuard Labs is monitoring active exploitation of multiple zero-day vulnerabilities affecting Ivanti Connect Secure (ICS), an enterprise remote access VPN solution. Threat actors have chained three vulnerabilities (CVE-2026-104935, CVE-2026-111357, and CVE-2026-118527) to achieve unauthenticated root-level code execution on vulnerable appliances. According to security researchers, the attacks have been observed since at least October 1, 2026. The activity was initially attributed to a previously unidentified threat actor tracked by Volexity as UTA0576. The attack chain begins with CVE-2026-104935, an authentication bypass vulnerability that allows remote attackers to e