Ivanti VPN and Windows Shell Zero-Days Confirmed Exploited in the Wild

Ivanti VPN and Windows Shell Zero-Days Confirmed Exploited in the Wild

•

Episode description

Ivanti VPN and Windows Shell Zero-Days Confirmed Exploited in the Wild

On 14 October 2026, CISA confirmed active exploitation of two critical zero-day vulnerabilities: CVE-2026-104935 in Ivanti Connect Secure VPN and CVE-2026-96951 in Windows Shell. The Ivanti flaw allows complete authentication bypass and root-level command execution without credentials, whilst the Windows vulnerability permits command injection across the operating system. Both vulnerabilities were added to CISA’s Known Exploited Vulnerabilities catalogue, confirming they are being used in live attacks. Security firm Volexity reported attackers chaining the Ivanti flaw with two additional zero-days to achieve full system compromise and credential theft. Microsoft’s October Patch Tuesday addressed 1,413 CVEs in total, the largest single-month release on record. This episode examines the immediate risks to UK small businesses, the forensic challenges of detecting compromise, and the specific patching actions required under Cyber Essentials and GDPR frameworks. Additional critical vulnerabilities in Adobe Commerce and ColdFusion are also covered, with practical guidance for businesses running e-commerce platforms.

Chapters

  • Introduction: Patch Tuesday and Two Confirmed Zero-Days Microsoft releases fixes for 1,413 vulnerabilities, including two actively exploited zero-days confirmed by CISA: an Ivanti VPN authentication bypass and a Windows Shell command injection flaw.
  • Ivanti Connect Secure Authentication Bypass (CVE-2026-104935) Analysis of the actively exploited Ivanti Connect Secure vulnerability allowing complete authentication bypass and root command execution. Covers Volexity’s research on threat actors chaining three zero-days, the forensic detection challenges, and specific patching requirements for UK businesses and MSPs.
  • Listener Call to Action Request for podcast follows, ratings, reviews, and sharing with other business owners who need critical vulnerability intelligence.
  • Windows Shell Command Injection (CVE-2026-96951) Examination of the Windows Shell zero-day included in October 2026 Patch Tuesday. Explains command injection mechanics, the scale of the 1,413-CVE release, and the 14-day patching requirement under Cyber Essentials certification.
  • Adobe Commerce and ColdFusion Critical Vulnerabilities Coverage of maximum-severity flaws in Adobe Commerce, Adobe Experience Manager, and ColdFusion published alongside Patch Tuesday, including arbitrary code execution and changed-scope vulnerabilities affecting UK e-commerce operators.
  • Business Impact and Patching Strategy Practical analysis of patching costs versus breach costs, MSP contractual obligations, regulatory requirements under GDPR and NIS Regulations, and the evidential value of documented patch confirmations.
  • Actionable Steps and Closing Specific tasks for the week: confirming Ivanti patches and integrity checks, deploying Windows updates including servers, verifying Adobe Commerce patches, reviewing VPN logs, and maintaining written records for regulatory due diligence.

Links