Patch Tuesday Panic: The Ivanti Zero-Day and Windows Shell Flaw Your Business Cannot Ignore
Two vulnerabilities confirmed as actively exploited. Both patched. Both being used against real targets as of the 13th of October 2026.
This is not vendor threat theatre. This is the United States government’s Cybersecurity and Infrastructure Security Agency adding two flaws to its Known Exploited Vulnerabilities catalogue: one in Ivanti Connect Secure, one in the Windows Shell. CISA’s KEV list is the closest thing intelligence analysts have to a ground-truth signal. When something lands on it, exploitation is confirmed, not theoretical.
This week also happened to be October 2026 Patch Tuesday, in which Microsoft addressed 1,413 vulnerabilities, including three zero-days. The sheer volume tells you something about the current patch debt accumulating across the industry. But for the purposes of this briefing, two items demand immediate attention.
Story One: Ivanti Connect Secure Is Being Actively Exploited Right Now
Ivanti Connect Secure, formerly known as Pulse Secure, is a VPN solution used by organisations to give staff remote access to internal networks. Many UK small businesses rely on it directly, or their managed service provider runs it on their behalf.
CVE-2026-104935 is an authentication bypass by spoofing vulnerability. In plain English: an attacker does not need a username or password to exploit it. They can reach the appliance over the internet, bypass the login process entirely, and execute arbitrary commands on the server. Root access. No credentials required.
Security firm Volexity reported on the 13th of October 2026 that an attacker had chained this flaw with two additional Ivanti Connect Secure zero-days to achieve full root-level command execution and steal stored credentials from at least one affected appliance. At the time of reporting, only two of the three chained vulnerabilities had patches available. Ivanti confirmed active exploitation and stated that a limited number of customers had been affected, though it did not disclose the precise number.
Ivanti’s advisory instructs customers to update to versions 25.1.1.2, 25.1.3.0, 25.1.3.1, or 22.8R2.5 and to run the Integrity Checker Tool on their appliances. Ivanti also noted that at the time of disclosure, no reliable Indicators of Compromise were available for organisations to use to confirm whether they had been targeted. That matters: the absence of IoCs does not mean you are clean. It means you cannot easily tell.
The supply chain implication here is direct. If your MSP manages Ivanti Connect Secure on your behalf and has not patched, your network perimeter is the MSP’s problem, which means it is also your problem. Ask the question.
Story Two: Windows Shell Command Injection, Confirmed In the Wild
CVE-2026-96951 is a command injection vulnerability in the Windows Shell. It allows an unauthorised attacker to bypass a security feature over a network. Microsoft included the fix in the October 2026 Patch Tuesday release, which was published on the 14th of October 2026.
The Dark Reading analysis of this Patch Tuesday release confirmed CVE-2026-96951 as one of the zero-day vulnerabilities included in October’s update. The CrowdStrike Patch Tuesday analysis noted that the October 2026 release covered 1,413 CVEs in total, including one exploited zero-day and two publicly disclosed zero-days, with 75 rated Critical.
For context: 1,413 CVEs in a single monthly release is not normal. The volume reflects both the acceleration of AI-assisted vulnerability discovery and the growing complexity of the Windows software stack. The number itself should not paralyse you. The principle is unchanged: prioritise the ones on the CISA KEV list. Apply the rest in your normal patching cycle.
For the Windows Shell flaw specifically: if you are running any supported version of Windows and have not applied the October 2026 updates, you are running software with a confirmed, actively exploited vulnerability. That is the data point. Draw your own conclusions about acceptable risk.
The Broader Context: Adobe and ColdFusion Also Had a Bad Week
The October 2026 NVD release included a wave of CVSS 10.0 vulnerabilities across Adobe Commerce, Adobe Experience Manager, and ColdFusion. Multiple code execution flaws, server-side request forgery, unrestricted file upload, and path traversal vulnerabilities were published in the same 24-hour window.
For UK small businesses running e-commerce on Adobe Commerce, this is directly relevant. CVE-2026-103849 allows arbitrary code execution in the context of the current user with no user interaction required and a changed scope rating, which in CVSS terms means the impact extends beyond the vulnerable component itself. CVE-2026-92909 carries the same profile. Neither is on the CISA KEV list at time of writing, but the exploitation window is open.
If your business runs an Adobe Commerce or Magento installation, your web developer or hosting provider needs to apply Adobe’s October security updates. Ask for confirmation in writing.
How This Gives You an Edge
Most small businesses do not have a patching process. They have a vague hope that their MSP is handling it, or a policy document written three years ago that nobody reads.
The businesses that apply patches on a defined schedule and ask their providers direct questions about specific CVEs are, objectively, harder targets. That is not a marketing claim. It is a measurable reduction in attack surface.
If your competitors are running unpatched Ivanti Connect Secure appliances and you are not, you are not equally exposed. Procurement teams and enterprise clients increasingly ask about patch management cadence in supplier questionnaires. Being able to document a structured response to high-severity vulnerabilities is a differentiator that costs nothing except discipline.
Cyber Essentials certification requires that high or critical severity vulnerabilities be patched within 14 days. CVE-2026-104935 and CVE-2026-96951 both qualify. Compliance with that requirement is not checkbox theatre here: it maps directly to the CISA-confirmed exploitation timeline.
Making the Business Case
Three arguments for whoever controls your IT budget:
The cost of not patching is measurable and recent. Ivanti Connect Secure has been exploited repeatedly over the past two years. When attackers gain root access to a VPN appliance, they can access everything the VPN protects: internal systems, file shares, cloud credentials, client data. The downstream cost of a breach, including ICO notification, customer communication, and recovery, will exceed the cost of a maintenance window by an order of magnitude.
Your MSP agreement may not protect you. Most MSP contracts do not include explicit SLAs for applying security patches within CISA-mandated timescales. If your provider has not patched CVE-2026-104935 and you are subsequently compromised, the contractual position is likely to be more complex than you would hope. Ask the question now, in writing, so you have a record.
The regulator will ask. Under GDPR and the NIS Regulations, organisations are required to implement appropriate technical and organisational measures. Running unpatched software with a known, actively exploited vulnerability is difficult to characterise as appropriate. The ICO’s enforcement decisions consistently consider whether organisations took reasonable steps to address known vulnerabilities.
What to Do Before the End of the Week
1. If you use Ivanti Connect Secure: Contact your MSP or IT provider today and ask specifically whether CVE-2026-104935 has been patched. Request confirmation that the appliance has been updated to one of the patched versions (25.1.1.2, 25.1.3.0, 25.1.3.1, or 22.8R2.5) and that the Integrity Checker Tool has been run. Get the confirmation in writing.
2. Apply October 2026 Windows updates: If you manage your own Windows devices, open Windows Update and apply all pending updates. If your MSP manages this, ask them to confirm that October’s Patch Tuesday updates have been deployed across your estate. Include servers, not just desktops.
3. If you run Adobe Commerce or Magento: Raise a ticket with your web developer or hosting provider requesting confirmation that Adobe’s October 2026 security patches have been applied. Do not wait for them to tell you.
4. Check your VPN logs: If you have access to logs from your VPN appliance or remote access solution, look for authentication events from unusual IP addresses or geographic locations in the past 30 days. If you do not have access to those logs, ask your MSP why not.
5. Document the conversation: Every time you ask your provider a specific question about a named CVE and receive a confirmed response, keep a record. That record is your evidence of due diligence in the event of a future incident or regulatory enquiry.
Patching is not exciting. It is also not optional when CISA is confirming active exploitation in the same news cycle as the patch release. The data is clear. The action is straightforward. The only variable is whether you take it.
If you found this useful: follow the podcast wherever you listen, leave a rating or review if you have a moment, drop a comment with your thoughts or questions, and share it with a business owner who needs to hear this. It genuinely helps.