Security Advisory

Patch Before October 16: Exploited Flaws in Ivanti Connect Secure and Windows Shell

October 15, 2026 · Cyber One Solutions Security Team

CISA added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog on October 13, 2026, both with an October 16 remediation date: an authentication bypass in Ivanti Connect Secure VPN appliances (CVE-2026-104935) and a Windows Shell flaw that lets crafted files slip past Mark of the Web protections (CVE-2026-96951). Here is who is affected, what attackers have done with the Ivanti flaw, and what to check this week.

On October 13, 2026, CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, meaning it has evidence that attackers are using them now: CVE-2026-104935 in Ivanti Connect Secure, a VPN appliance many businesses use for remote access, and CVE-2026-96951 in Windows Shell. CISA's catalog lists an October 16, 2026 due date for both. That is the catalog date rather than a single deadline for every system: under Binding Operational Directive 26-04, federal civilian agencies set each affected asset's actual remediation timeline from its exposure, and none of it binds private businesses. Still, a three-day catalog date shows how urgently CISA rates both flaws. If you run either product, patch this week.

Ivanti Connect Secure: CVE-2026-104935

What it is. CISA's KEV entry describes CVE-2026-104935 as an authentication bypass by spoofing that "allows a remote unauthenticated attacker to execute arbitrary commands" on the appliance. In other words, an attacker on the internet does not need a password to run commands on the device that sits at the edge of your network. Ivanti disclosed the flaw on October 13 and says it is aware of limited exploitation in the wild.

Who is affected. CISA's alert lists Ivanti Connect Secure versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. Ivanti's security advisory names the fixed release for each branch. CISA also notes that the 22.8 branch reaches end of life on January 31, 2027, so an appliance still on 22.x needs a plan to move to 25.x regardless.

What attackers did with it. Volexity, the security firm that investigated the first known attacks, reports that exploitation began on October 3, 2026, against an appliance that was fully patched at the time. After getting in, the attacker harvested the domain credentials the appliance used for LDAP, searched Active Directory for LAPS passwords and BitLocker recovery keys, ran password spraying against domain accounts, deployed a custom Kerberos tool that Volexity notes was capable of Kerberoasting (though the attacker's script did not use that function), and deleted log entries to cover their tracks. Volexity also reports a related privilege escalation flaw in the same attack chain that Ivanti had not yet fixed, and that Ivanti is working on a fix that "will be included in a future release in the coming weeks."

Why a clean scan is not proof. CISA warns that Ivanti's Integrity Checker Tool may not detect this exploitation because the attacker's commands run in memory, and Volexity found the same: the tool reported no changes on a compromised device. A clean Integrity Checker result does not show that an appliance was untouched.

Ivanti Connect Secure: What to Do Now

Upgrade any Ivanti Connect Secure appliance on an affected release (the 25.1.1, 25.1.2, and 22.8R2 trains listed above) to the fixed build for its own code line. Ivanti's listing, as reproduced by Rapid7, maps them as follows: 25.1.1.1 and prior to 25.1.1.2; 25.1.2.2 and prior to 25.1.3.0 or 25.1.3.1; and 22.8R2.4 and prior to 22.8R2.5. Ivanti's CVE record also says version 22.7R2.14 and earlier are not affected by this flaw. Follow Ivanti's 25.x upgrade and migration guide where you are moving off 22.x, which remains worth planning for older 22.x appliances on its own schedule.
If the appliance was internet-facing on a vulnerable version since early October, treat compromise as possible. Before any reset or rebuild, isolate it and preserve evidence: Volexity says confirming compromise requires network and memory forensics because this chain runs in memory and the Integrity Checker may not detect it, and a factory reset destroys that volatile evidence. Once that triage is done, CISA's recovery steps are to back up the configuration, factory reset and upgrade the appliance (rebuild cloud and virtual appliances), restore the configuration, and then reset passwords for all domain, administrator, and local accounts, revoke and reissue stored certificates, and reset stored API keys and license server credentials.
Rotate the Active Directory service account the appliance uses for LDAP, since that is the credential Volexity saw stolen, and review recent activity from it.
Watch for traffic from the VPN appliance into the rest of your network that it does not normally make, and for a surge of directory queries or Kerberos service-ticket requests.
Watch for Ivanti's fix for the related privilege escalation flaw and apply it when it ships.

Windows Shell: CVE-2026-96951

What it is. Microsoft's Security Update Guide lists CVE-2026-96951 as a Windows Shell Security Feature Bypass Vulnerability, rated Important with a CVSS 3.1 score of 8.8, and marks it as exploited. Microsoft's FAQ for the CVE explains that an attacker who exploits it "could evade Mark of the Web (MOTW) defenses."

Why that matters. Mark of the Web is the tag Windows adds to files that arrive from the internet, such as browser downloads and email attachments. Other protections key off it: Microsoft 365 apps, for example, block macros in Office files that carry it. A file that loses that tag can open without those warnings and blocks. Microsoft describes the attack as an email or instant message carrying a specially crafted file, or a link to an attacker's site; the user has to be persuaded to open it, so this is a phishing-delivered flaw rather than one that spreads on its own.

Who is affected. Microsoft released fixes on October 13, 2026, in that month's security updates, for currently supported Windows 11 releases, for Windows 10 versions that still receive security updates (long-term servicing editions and systems enrolled in Extended Security Updates), and for Windows Server 2016, 2019, 2022, 2025, and 2012 R2 under Extended Security Updates. For Windows Server 2012 R2, that October 13 release was the final update Extended Security Updates will provide; a 2012 R2 server without ESU did not receive the fix.

Windows Shell: What to Do Now

Install the October 2026 security update on every Windows workstation and server that Microsoft still provides updates for, including any Windows 10 or Windows Server 2012 R2 system enrolled in Extended Security Updates, and confirm it actually installed rather than assuming it did. Microsoft's Security Update Guide lists the update number for each Windows version.
For any system that cannot receive this update, such as Windows Server 2012 R2 without Extended Security Updates or an unenrolled Windows 10 machine, an empty update search is not remediation: isolate it from email and file-sharing use, and plan its upgrade or replacement.
Prioritize the machines whose users open email attachments and chat files: front office, accounting, and anyone who handles invoices or shared documents.
Keep email attachment filtering and Microsoft Defender SmartScreen turned on; they still help, even though this flaw targets one of the protections in that chain.
Remind staff that an unexpected attachment or link is worth a phone call to the sender before opening, especially this month.

Why This Belongs on Your Radar

Both flaws hit two of the most exposed parts of a small business network: the remote access gateway that faces the internet, and the inbox. Neither depends on an unusual configuration. Keep a dated record of when each fix was applied and what you checked; if a customer, auditor, or insurer later asks how you handle actively exploited vulnerabilities, that record is the answer.

Cyber One Solutions tracks CISA's Known Exploited Vulnerabilities catalog and vendor advisories as part of our managed cybersecurity service, and deploys and verifies Windows security updates through our managed IT services. If you are not sure whether your VPN appliance or your Windows fleet is current, our IT and security assessments can confirm exactly what is running and what needs attention first.