Today's briefing covers two vulnerabilities CISA added to its Known Exploited Vulnerabilities Catalog on 2026-10-13, an Ivanti Connect Secure authentication bypass used for credential theft and data exfiltration and a Windows Shell security-feature bypass, plus one industrial control system advisory. The ICS item, in Inductive Automation Ignition, turns an ordinary authenticated session into code execution in the Gateway process.
CISA reports that threat actors are exploiting CVE-2026-104935, a zero-day authentication bypass in Ivanti Connect Secure that allows remote, unauthenticated execution of arbitrary commands, and that the access has been used for credential theft and data exfiltration. Affected versions are 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. CISA added the CVE to its Known Exploited Vulnerabilities (KEV) Catalog on 2026-10-13.
CISA urges organizations with affected appliances and deployments to update to the latest version immediately, following Ivanti's security advisory for the CVE and the Ivanti Connect Secure 25.x Upgrade and Migration Compatibility Guide for hardware and virtual appliance deployments. Version 22.8 reaches end of life on 2027-01-31. CISA notes that Ivanti's Integrity Checker Tool may not detect evidence of exploitation because the threat actor's commands execute in memory; determining whether an appliance was compromised requires network and memory forensics. Where compromise is suspected, CISA points to Ivanti's Connect Secure Recovery Procedures, starting with a backup of the appliance configuration.
An authentication bypass with command execution on a remote-access gateway hands an unauthenticated attacker the system that sits in front of the network, and the reported objectives, credentials and data, are what that position yields. Because the vendor's integrity checker may miss in-memory activity, a clean check is not evidence of a clean appliance, and patching closes the entry point without answering whether it was already used. Operators should update now, treat any appliance that ran an affected version as potentially compromised until network and memory forensics say otherwise, treat credentials that passed through the appliance as exposed, follow Ivanti's recovery procedures where compromise is suspected, and plan the move off the 22.8 branch before its 2027-01-31 end of life.
CISA's advisory ICSA-26-286-01 covers CVE-2026-92817, an incorrect-authorization flaw (CVSS v3 8.8) in Inductive Automation Ignition versions 8.1.0 through 8.1.54 and 8.3.0 through 8.3.8. The Perspective module does not properly validate session privileges when it determines Designer-level access: an authenticated user with access to a Vision project can provide a valid Vision session identifier and gain Designer-level privileges. An attacker could use those elevated privileges to execute arbitrary code in the context of the Ignition Gateway process. The product is deployed worldwide in the critical manufacturing, energy, and information technology sectors. Inductive Automation has released versions 8.1.55 and 8.3.9 to address the issue and recommends updating to the newest available version; further detail is published in the vendor's Trust Center.
The precondition is an ordinary authenticated account, not an outside attacker: any user who can open a Vision project is one step from Designer rights and from code running inside the Gateway process. That makes the flaw an insider and lateral-movement path whose exposure is measured by how many people and service accounts hold Vision access, not by internet reachability alone. Operators should move 8.1 installations to 8.1.55 or later and 8.3 installations to 8.3.9 or later, review who holds Vision project access until the update is in place, and investigate Designer-level sessions that do not belong to known engineering users.
CISA added CVE-2026-96951 to the Known Exploited Vulnerabilities Catalog on 2026-10-13. The entry describes a command injection vulnerability in Microsoft Windows Shell that allows an unauthorized attacker to bypass a security feature over a network. The required action is to apply mitigations according to the vendor's instructions, in line with Binding Operational Directive (BOD) 26-04, Prioritizing Security Updates Based on Risk, and CISA's Forensics Triage Requirements, to follow the directive's guidance for cloud services, or to discontinue use of the product if mitigations are unavailable. The entry also makes stakeholders responsible for evaluating each asset's internet exposure. The due date is 2026-10-16, three days after the listing, and known ransomware campaign use is recorded as unknown.
A KEV listing records evidence of active exploitation, and this one concerns a network-reachable security-feature bypass in a Windows component with a three-day remediation window. The due date is set under a binding operational directive, but organizations outside its scope carry the same exposure on their own Windows estates. Operators should apply Microsoft's mitigations for CVE-2026-96951 before 2026-10-16, starting with internet-exposed assets as the entry directs, and, because the required action pairs mitigation with CISA's forensics triage requirements, record whether exposed hosts show signs of compromise instead of closing the item on patch status alone.
