CISA warns of new Ivanti bug being exploited as latest Patch Tuesday breaks records

Researchers and government agencies sounded the alarm on Tuesday a new vulnerability affecting a VPN tool from IT software vendor Ivanti.

The Cybersecurity and Infrastructure Security Agency (CISA) gave all federal civilian agencies until Friday to patch CVE-2026-104935 — a bug found in Ivanti’s Connect Secure product. The vulnerability carries a severity score of 8.6 out of 10 and Ivanti confirmed it is being exploited.

Several cybersecurity firms also confirmed it is being exploited in the wild and experts from Volexity published an extensive blog covering their work discovering the vulnerability before reporting it to Ivanti. Both CISA and Ivanti urged defenders to follow Volexity’s guidance.

Volexity said it began investigating malicious activity on October 5 that led them to a fully patched Ivanti VPN appliance that had been abused starting two days earlier. Volexity found three zero-day exploits, two of which were patched by Ivanti on Tuesday. Ivanti is working on a fix for the third issue.

Volexity’s incident responders did not find any malware that would have allowed the attackers to take actions without re-exploiting the VPN appliance.

The threat actors behind the initial exploitation appeared to focus on credential theft, data exfiltration, log tampering and network reconnaissance.

“Volexity assesses with low confidence that [the threat actor] has criminal, rather than espionage, motivations based on the target of this activity,” Volexity said.

CISA said in its own Tuesday evening advisory that it is “aware of cyber threat actors exploiting this zero-day … which allows remote, unauthenticated execution of arbitrary commands, to conduct credential theft and data exfiltration.”

Ivanti added that it is working with a “limited number of customers” who were exploited through the bug.

This is the sixth Ivanti vulnerability added to CISA’s list of exploited bugs in 2026. The company’s products have been repeatedly targeted by nation-state actors due to their wide use by governments globally. The company pledged a security overhaul in 2024 after a cascade of headline-grabbing nation-state attacks broke through the systems of government agencies in the U.S. and Europe .

Microsoft breaks 1,000 bugs for October Patch Tuesday

Alongside the Ivanti bug, CISA warned federal agencies that a new Microsoft vulnerability is also being exploited.

The bug — CVE-2026-96951 — is a Windows Shell security feature bypass and carries an 8.8 severity score out of 10. Federal agencies have until Friday to patch it.

Microsoft said an attacker could send a victim a specially crafted file that is designed to exploit the vulnerability.

“In any case an attacker would have no way to force a user to view attacker-controlled content. Instead, an attacker would have to convince a user to take action. For example, an attacker could entice a user to either click a link that directs the user to the attacker's site or send a malicious attachment,” Microsoft said in its advisory the bug.

The vulnerability was one of more than 1,400 bugs included in Microsoft’s October Patch Tuesday release.

Several experts said this was a record for one month after the record of 973 was set last month .

“This month, there were more CVEs patched (1,407) than in the record-setting year 2020, when Microsoft patched 1,261 CVEs,” said Tenable’s Satnam Narang. “We’ve now crossed the 4,000 CVE mark with two months left to go.”