A newly discovered flaw in Ivanti's Connect Secure VPN appliance has triggered urgent warnings from cybersecurity authorities and private researchers this week. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has instructed all federal civilian agencies to apply patches for CVE-2026-104935 by Friday. The vulnerability, rated 8.6 on a severity scale of 10, is already being weaponised by attackers in active campaigns, with Ivanti confirming the exploitation.
Multiple security vendors have independently verified that the flaw is being exploited in real-world attacks. Researchers at Volexity, who discovered the vulnerability and disclosed it responsibly to Ivanti, published detailed technical analysis of their findings. Both CISA and Ivanti directed defenders to follow Volexity's published guidance on the issue.
Volexity's investigation began on October 5 after detecting suspicious activity targeting a fully patched Ivanti appliance that had already been compromised two days prior. The security team uncovered three separate zero-day exploits during their analysis. Ivanti released patches for two of these on Tuesday, while work continues on addressing the third vulnerability.
The incident responders found no evidence of persistent malware installed by the attackers, suggesting they relied on repeated exploitation of the VPN appliance to maintain access. The threat actors' activities centred on harvesting credentials, stealing data, removing audit logs and mapping the target network. Volexity assessed with low confidence that the attackers were motivated by financial gain rather than state-sponsored espionage, based on the nature of their targets.
CISA's advisory noted that the flaw enables "remote, unauthenticated execution of arbitrary commands" and has been leveraged for "credential theft and data exfiltration." Ivanti stated it is collaborating with a "limited number of customers" affected by the exploitation.
This marks the sixth Ivanti vulnerability to appear on CISA's catalogue of actively exploited bugs this year. Ivanti's infrastructure has become a persistent target for nation-state actors given its prevalence in government networks worldwide. The vendor committed to a comprehensive security improvement programme in 2024 following a series of high-profile breaches affecting U.S. and European government agencies.
Microsoft reaches historic patch volume
Alongside the Ivanti alert, CISA flagged a second vulnerability being exploited in the wild: CVE-2026-96951, a Windows Shell security feature bypass rated 8.8 out of 10. Federal agencies must patch this flaw by Friday as well.
Microsoft's advisory explains that the bug could be triggered when a user opens a specially crafted file. "In any case an attacker would have no way to force a user to view attacker-controlled content. Instead, an attacker would have to convince a user to take action. For example, an attacker could entice a user to either click a link that directs the user to the attacker's site or send a malicious attachment," the company stated.
The vulnerability was among more than 1,400 bugs patched by Microsoft in its October Patch Tuesday release, surpassing previous records for monthly patch volume. Security researchers noted that the 1,407 CVEs addressed this month exceeds the previous single-month record of 973 set in September, and even surpasses the entire 2020 year total of 1,261 patches.
"This month, there were more CVEs patched (1,407) than in the previous record-setting year 2020, when Microsoft patched 1,261 CVEs," said Tenable's Satnam Narang. "We've now crossed the 4,000 CVE mark with two months left to go."
