Today’s Field Note

Volexity caught an actor chaining three Ivanti Connect Secure zero-days (CVE-2026-104935 among them) for unauthenticated remote code execution as root against fully patched appliances. Ivanti shipped fixes for two of the three and is telling customers to act immediately; the third fix is still pending, so patching does not fully close the door yet. This is the same playbook that has burned Ivanti edge devices repeatedly, and edge appliances do not give you the luxury of waiting for a maintenance window. Separately, Microsoft’s October Patch Tuesday is a record 1,411 flaws including CVE-2026-96951, a Windows security feature bypass already exploited in the wild, plus two publicly disclosed zero-days. Prioritize the edge first, then the endpoint.

Today’s Action

  • Patch Ivanti Connect Secure now for the two fixed zero-days, and treat the third (unpatched) as an active exposure: restrict management access and watch for the pending fix.
  • Hunt your ICS appliances for compromise using Volexity’s indicators and Ivanti’s Integrity Checker Tool; assume breach on internet-facing gateways and rotate secrets if anything looks off.
  • Deploy Microsoft’s October updates, prioritizing CVE-2026-96951 (exploited) and the two publicly disclosed zero-days ahead of the full 1,411-flaw batch.
  • Patch Ghostscript (CVE-2026-39919) on any server that renders uploaded PDFs, a common and overlooked RCE path.
  • Rotate SAP BTP OAuth2 client credentials if you run multi-tenant apps on the Cloud SDK for Python (CVSS 10).

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

You patched the box. The root shell was already inside.

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @itsalreadywhen or subscribe via RSS.