Circuit Wire — a daily news update from the Circuit.
The US Cybersecurity and Infrastructure Security Agency (CISA) added an actively exploited Ivanti Connect Secure flaw, CVE-2026-104935, to its exploited vulnerabilities list on Tuesday, October 13, The Record reported. Federal civilian agencies have until Friday to patch.
The bug affects Ivanti's VPN product and carries a severity score of 8.6 out of 10. Ivanti has confirmed it is being exploited and says it is working with a limited number of affected customers.
Researchers at Volexity began investigating on October 5. They found that a fully patched Ivanti VPN appliance had been abused starting two days earlier. Volexity identified three zero-day flaws in total. Ivanti patched two of them on Tuesday and is still working on a fix for the third.
Volexity saw attackers steal credentials, pull data out of the network, tamper with logs and scout the network from the appliance. It found no malware that would let the attackers return without exploiting the appliance again. The firm assessed, with low confidence, that the actor is a criminal group rather than a spy service.
The Canadian Centre for Cyber Security published its own advisory on October 13. It lists affected versions of Connect Secure as 25.1.1.1 and prior, 25.2.2 and prior, and 22.8R2.4 and prior. Two other Ivanti products are also covered: Neurons Patch for Intune, in versions before September 16, 2026, and Xtraction, in versions 2026.2.1 and prior. The Centre advises administrators to review the Ivanti advisories and install updates as they become available.
This is the sixth Ivanti vulnerability CISA has added to its exploited list in 2026. Ivanti pledged a security overhaul in 2024 after attacks by nation-state groups.
CISA also gave agencies a Friday deadline for a second flaw, CVE-2026-96951, a Windows Shell security feature bypass rated 8.8. Microsoft says an attacker would need to persuade a user to click a link or open a malicious attachment. The warning came as Microsoft's October Patch Tuesday fixed more than 1,400 bugs. Tenable counted 1,407, a record that beat the 973 patched in September.
Want a weekly roundup of the major stories shaping the security industry? The On The Circuit newsletter is read by more than 12,000 protection professionals.
Spotted something we should cover? Send tips and feedback via circuit-magazine.com.