The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding a newly exploited vulnerability in Ivanti's Connect Secure product. This vulnerability, identified as CVE-2026-104935, holds a severity rating of 8.6 out of 10 and is actively being exploited, prompting CISA to mandate federal civilian agencies to apply necessary patches by Friday. Volexity, a cybersecurity firm, discovered the vulnerability during an investigation of suspicious activities, revealing three zero-day exploits. While Ivanti has patched two of these, the company is still working on a fix for the third.

The exploitation primarily targets credential theft, data exfiltration, and network reconnaissance, although no persistent malware has been detected. Ivanti is collaborating with a limited number of affected clients to address the issue. This marks the sixth Ivanti vulnerability to be included in CISA's list of exploited bugs in 2026, highlighting the repeated targeting of the company's products by nation-state actors due to their global governmental use.

Simultaneously, CISA has alerted agencies about a new Microsoft vulnerability, CVE-2026-96951, affecting the Windows Shell security feature. This vulnerability poses an 8.8 severity rating and can be exploited by sending users a specially crafted file. Microsoft advises that attackers must persuade users to engage with malicious content to exploit the vulnerability effectively.

This warning comes as Microsoft releases its October Patch Tuesday, which addresses over 1,400 vulnerabilities, surpassing previous records and bringing the total number of CVEs patched this year to over 4,000. Security experts emphasize the importance of timely patching to safeguard systems against potential threats.