Ivanti Connect Secure and Windows Shell zero-days hit CISA KEV

CISA adds two actively exploited bugs on October 13

CISA added two vulnerabilities to the Known Exploited Vulnerabilities catalog on October 13, and both are already under attack. CVE-2026-104935 is an authentication bypass by spoofing in Ivanti Connect Secure, carrying a CVSS of 8.6. CVE-2026-96951 is a Microsoft Windows command injection flaw, reported as an actively exploited Windows Shell zero-day. KEV listing means these move from the patch-eventually pile to the patch-now pile.

CISA issued a separate alert urging admins to immediately fix the newly exploited Ivanti Connect Secure flaw. The reporting is worse than a single bug: researchers describe attackers chaining three Ivanti zero-days to gain root on fully patched VPN appliances, and separate coverage says Connect Secure zero-days were used to steal Active Directory credentials. If you run Connect Secure, treat the appliances as exposed and work through Ivanti's guidance now, then hunt for signs of credential theft on connected domain controllers.

The Windows Shell zero-day inside a record Patch Tuesday

Microsoft's October Patch Tuesday broke records. SecurityWeek reports Microsoft patched 1,413 vulnerabilities including the exploited Windows zero-day CVE-2026-96951, while Cyber Security News counts 1,118 fixes and notes Microsoft introduced new risk cohorts in its reporting. Whatever the headline number, the one to prioritize is the actively exploited Windows Shell command injection.

The cumulative updates this month carry large CVE counts. KB5122871 for Windows Server 2025 Server Core addresses 687 CVEs, KB5122882 for Windows Server 2022 covers 648, and KB5122876 for Windows 10 Version 1809 covers 623, all rated Critical and all flagged as containing KEV-listed content. Before you deploy, note that Microsoft warns recent Windows updates may trigger Remote Desktop failures, so stage and watch RDP after rollout.

Beyond the exploited zero-day, this month's Windows research also covers BitLocker security feature bypass and privilege elevation (CVE-2026-85920, CVE-2026-88070, CVE-2026-83500) and a SmartScreen privilege escalation (CVE-2026-85851). None are listed as exploited yet, but they belong in the same patch cycle.

Exploitation movers worth a look

Several KEV-listed CVEs with ransomware links are running hot on exploitation prediction. CVE-2026-41940 in WebPros cPanel and WHM sits at EPSS 0.9853, CVE-2026-0257 in Palo Alto Networks PAN-OS at 0.9689, CVE-2026-35273 in Oracle PeopleSoft at 0.9668, and CVE-2026-63077 in JetBrains TeamCity at 0.8957. All four are Critical, all are ransomware-linked, and all are in KEV. Older KEV entries are still climbing too, including CVE-2015-3306 in ProFTPD at EPSS 0.995 and CVE-2015-5477 in ISC BIND at 0.9941.

Also on the radar this week: a critical FortiSandbox GUI authentication bypass (CVE-2026-107656) and a critical Docker Hub flaw (CVE-2026-105445) that lets attackers impersonate users and push container images.

Do this first

Work the exploited items ahead of the volume. Priority order for most Microsoft 365 and Entra shops:

• Patch Ivanti Connect Secure for CVE-2026-104935 immediately, then hunt for stolen Active Directory credentials given the reported chaining to root.
• Deploy this month's Windows cumulative update to close CVE-2026-96951, and watch for Remote Desktop failures after rollout.
• Confirm your exposure to ransomware-linked KEV CVEs in cPanel, PAN-OS, PeopleSoft, and TeamCity, and schedule those next.
• Use the free Senserva Microsoft Patch Tracker to rank your open Microsoft patches by CISA KEV, EPSS, and ransomware linkage, and the non-Microsoft exploited-CVE tracker to follow KEV additions like the Ivanti bug.

Sources

• CISA Cybersecurity Advisories: CISA Adds Two Known Exploited Vulnerabilities to Catalog (2026-10-13)
• CISA Cybersecurity Advisories: CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure (2026-10-13)
• Cyber Security News: Microsoft Windows Shell 0-Day Vulnerability Actively Exploited in Attacks (2026-10-14)
• SecurityWeek: Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day (2026-10-14)
• Help Net Security: Attackers chained three Ivanti zero-days to gain root on fully patched VPN appliances (2026-10-14)
• Cyber Security News: Ivanti Connect Secure 0-Days Exploited to Steal Active Directory Credentials (2026-10-14)
• BleepingComputer: CISA warns admins to immediately fix Ivanti flaw exploited as zero-day (2026-10-14)
• BleepingComputer: Microsoft: Recent Windows updates may trigger Remote Desktop failures (2026-10-14)
• Cyber Security News: Windows BitLocker Vulnerabilities Security Feature Bypass and Privilege Elevation Attacks (2026-10-14)
• Cyber Security News: Windows SmartScreen Vulnerability Enables Privilege Escalation Attacks (2026-10-14)
• Cyber Security News: Critical FortiSandbox GUI Vulnerability Allows Remote Attackers to Bypass Authentication (2026-10-13)
• Cyber Security News: Critical Docker Hub Flaw Lets Attackers Impersonate Users and Push Container Images (2026-10-13)
• Cyber Security News: Microsoft Fixes 1,118 Vulnerabilities in October Patch Tuesday and Introduces New Risk Cohorts (2026-10-13)

Written by Senserva Trustworthy AI from the day's live partner feeds (CISA KEV, MSRC, FIRST EPSS, and the trusted press list), validated so every CVE, KB, and reference resolves to that data. The sources behind every feed, and their terms, are on our Data sources & thanks page. Facts as of 2026-10-14.

Senserva is a Microsoft security company and a member of the Microsoft Intelligent Security Association. Senserva audits your Microsoft 365, Intune, Defender, and Entra ID environment: complete patch state, 650+ security checks, and full reports, with clear guidance on what to fix first.