1,415 Patches, One Fire. The Other Three-Day Deadline Today Is Ivanti's, and Our Edge Couldn't See It.
Microsoft shipped fixes for 1,415 vulnerabilities today. One of them is being exploited. CISA put that one in its Known Exploited Vulnerabilities catalog the same afternoon with a deadline of Thursday, October 16. It also put a second bug in the catalog with the same Thursday deadline, and that one isn't Microsoft's at all. It's Ivanti Connect Secure, the VPN appliance that has now made the KEV list fifteen times. If you run a small shop and can only do two things this week, those are the two.
The one Microsoft bug that is already being used
CVE-2026-96951 is a Windows Shell flaw that Microsoft rates Important, CVSS 8.8, and marks "Exploitation Detected." It's a command-injection bug that lets a crafted file get past Mark of the Web. That's the tag Windows puts on anything downloaded from the internet, and it's what triggers the "are you sure you want to open this?" warning and Office's Protected View. Get around it and a booby-trapped attachment opens like a file you made yourself.
The way in is ordinary. Microsoft's own description is an email or instant message with a crafted file, and a user who has to be talked into opening it. Nothing about it needs a server, a VPN or an exposed port. That's why our edge has nothing to say about this one, by design. It travels by mail and chat, and a web edge never sees mail.
The free fix is the October cumulative update. Until it's on every machine, do the cheap things that blunt the whole class. Have your mail filter strip or quarantine shortcut files, internet shortcuts and disk images from outside senders. Keep SmartScreen turned on. Tell the people who handle invoices and resumes that "the file opened with no warning" is itself a warning.
The other 1,414, and the part nobody can explain yet
1,415 is a strange number for a Patch Tuesday. In 2024 and 2025 a heavy month ran well under 200. This month's breakdown, from Microsoft's own security update document: 77 Critical, 675 elevation of privilege, 316 remote code execution, 253 information disclosure. Among the Critical remote code execution bugs are a lot of services that small networks quietly run: DHCP Server, Message Queuing, QUIC, Network Policy Server, Routing and Remote Access, and several in Outlook. None of those is marked exploited today. Patch them on your normal schedule, and sooner for anything that faces the internet.
Read the credits and something else shows up. 68 of the 1,415 credit an AI tool by name: diffract-ai, z.ai's GLM, XBREACH.AI, minsight-ai and Claude. The exploited Windows Shell bug itself lists a researcher "using Claude with Anthropic" among its three credits. We aren't claiming AI explains the jump from under 200 to 1,415. Credits name a minority of findings, and Microsoft hasn't said why the month is so large. But AI-assisted research credited on roughly one fix in twenty, in one month, is a dated observation worth keeping. We'll check it against November.
Ivanti Connect Secure, fifteenth time on the list
CVE-2026-104935 is, in CISA's words, an authentication bypass in Ivanti Connect Secure that lets a remote unauthenticated attacker run arbitrary commands. No login required, on a box whose whole job is to sit on the internet and let people into your network. CISA flags ransomware use as unknown for now.
History is the reason to move fast. Counting its Pulse Secure years, Connect Secure now has fifteen KEV entries. Eight of the fourteen before today are flagged for known ransomware use, including the January 2024 chain (CVE-2023-46805 and CVE-2024-21887) and both 2025 entries. When this product family gets a no-login bug, the usual pattern is mass exploitation within days, not weeks.
What to do, at no cost: apply Ivanti's fix for this CVE per their advisory today, and run Ivanti's own Integrity Checker Tool, the external one, to look for signs that someone got in first. If you can't patch by Thursday, take the appliance's web interface off the open internet until you can. A VPN that's down for a day is a bad Tuesday. A VPN that hands out a shell is a breach.
What our edge saw: nothing, and why that number lies
We ran our standard check across every edge instrument for the paths Connect Secure scanners use, the /dana-na/ login and its sibling directories. Since January 1: zero matching probes in 2,941,882 edge blocks and 139,334 canary hits. The same check finds 687 WordPress login probes this month alone, so the instrument works.
That zero isn't quiet. It's blindness. We don't run Ivanti, so nothing at our edge looked like Ivanti, and a scanner fingerprinting Connect Secure boxes had no reason to come back after its first look. We measured this exact blind spot for NetScaler, FortiGate, PeopleSoft and SharePoint, and closed each one the same way.
So we closed this one too. Edge Shield 2.10.0, live at our edge as of today, answers /dana-na/, /dana-ws/, /dana-cached/ and /dana/ like a Connect Secure sign-in page. Hits are recorded with a marker for the traversal tricks from the 2024 chain and for encoded paths that try to slip past filters. We deliberately did not trap Ivanti's /api/v1/ paths, because our own API lives under /api/v1/ and a canary there would break it. The next time someone sweeps the internet for Connect Secure, we get a timestamp instead of a zero. The same release fixed a bug we found in our own FortiGate decoy, which had been sending the wrong product's cookie since October 13's earlier release.
If you run Edge Shield on your own zone and don't run Ivanti, you can opt in to these canaries with APPLIANCE_CANARIES. If you do run a real Connect Secure behind the same zone, leave it off. A decoy in front of your real VPN login would break it.
If you only have an hour
First, find out whether you have an Ivanti Connect Secure or Pulse Secure appliance. If you do, that's your hour. Patch it, run the external Integrity Checker, and if you can't patch, pull its web interface off the internet. Then push the October Windows update to the machines that read email first: front desk, billing, HR, anyone who opens attachments from strangers for a living.
CISA's catalog and Microsoft's October security update guide are the primary sources for every date and rating above.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=patch-tuesday-october-2026-1415-patches-one-exploited-ivanti-connect-secure-kev
Comments