Full Report
The sixth exploited Ivanti bug this year drew attention from the feds and researchers, while a severe Microsoft vulnerability was one of more than 1,400 listed for Patch Tuesday.
Analysis Summary
# Vulnerability: Ivanti Connect Secure Unauthenticated Remote Command Execution
## CVE Details
- **CVE ID:** CVE-2026-104935
- **CVSS Score:** 8.6 (High)
- **CWE:** Not specifically listed (Description indicates Command Injection/Improper Neutralization)
## Affected Systems
- **Products:** Ivanti Connect Secure (formerly Pulse Secure)
- **Versions:** Vulnerable versions include those considered "fully patched" prior to the October 13, 2026, release.
- **Configurations:** VPN appliances exposed to the network.
## Vulnerability Description
The flaw is a zero-day vulnerability that allows a remote, unauthenticated attacker to execute arbitrary commands on the Ivanti Connect Secure gateway. Volexity researchers identified this as part of an exploit chain involving three zero-days, where attackers bypassed security controls to gain initial access.
## Exploitation
- **Status:** Exploited in the wild (Active exploitation confirmed by CISA and Volexity).
- **Complexity:** Low (Unauthenticated access).
- **Attack Vector:** Network.
## Impact
- **Confidentiality:** High (Credential theft and data exfiltration reported).
- **Integrity:** High (Log tampering and command execution).
- **Availability:** High (Potential for full system takeover).
## Remediation
### Patches
- Ivanti released patches for two of the three discovered zero-days on Tuesday, October 13, 2026. Users should update to the latest firmware versions provided in the Ivanti advisory.
- Note: A fix for a third related issue is currently in development.
### Workarounds
- Federal agencies (FCEB) have been mandated by CISA to apply patches by Friday, October 16, 2026.
- Restrict access to the management interface and monitor for unusual outbound traffic from VPN appliances.
## Detection
- **Indicators of Compromise:** Look for evidence of credential dumping, unusual network reconnaissance from the appliance, and evidence of log tampering to hide malicious activity.
- **Detection methods and tools:** Follow specific guidance published by Volexity and Ivanti for incident response.
## References
- Ivanti Security Advisory: hXXps://hub.ivanti[.]com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935
- Volexity Research Blog: hXXps://www.volexity[.]com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/
- CISA Alert: hXXps://www.cisa[.]gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure
***
# Vulnerability: Windows Shell Security Feature Bypass
## CVE Details
- **CVE ID:** CVE-2026-96951
- **CVSS Score:** 8.8 (High)
- **CWE:** Security Feature Bypass
## Affected Systems
- **Products:** Microsoft Windows
- **Versions:** Multiple versions covered in the October Patch Tuesday release (Record 1,407 CVEs).
- **Configurations:** Systems where users can be enticed to open malicious files or click untrusted links.
## Vulnerability Description
A security feature bypass vulnerability in the Windows Shell. The flaw allows an attacker to bypass standard security warnings or protections (such as Mark-of-the-Web) by convincing a user to interact with a specially crafted file or malicious link.
## Exploitation
- **Status:** Exploited in the wild (Confirmed by CISA).
- **Complexity:** Medium (Requires user interaction/social engineering).
- **Attack Vector:** Network (via malicious attachment or web link).
## Impact
- **Confidentiality:** High
- **Integrity:** High
- **Availability:** Medium
## Remediation
### Patches
- Apply the October 2026 Microsoft Patch Tuesday updates immediately.
### Workarounds
- None provided; patching is the primary remediation.
## Detection
- Monitor for execution of suspicious files downloaded from the internet that bypass standard MOTW (Mark-of-the-Web) flags.
- Endpoint Detection and Response (EDR) monitoring for anomalous Windows Shell activity.
## References
- Microsoft Security Update Guide: hXXps://msrc.microsoft[.]com/update-guide/en-US/vulnerability/CVE-2026-96951