CISA orders urgent patching of new Ivanti bug amid record Microsoft Patch Tuesday

CISA gave US federal agencies until Friday to fix CVE-2026-104935 in Ivanti Connect Secure (severity 8.6), which is being actively exploited. Volexity found three zero-days, two patched by Ivanti on Tuesday. Microsoft's October Patch Tuesday fixed a record 1,407 bugs, including exploited Windows Shell flaw CVE-2026-96951 (8.8).

• CVE-2026-104935 in Ivanti Connect Secure scores 8.6; patch deadline Friday
• Volexity found three zero-days; Ivanti patched two, fix for third pending
• Microsoft fixed 1,407 CVEs in October, beating September's record of 973
• Windows Shell CVE-2026-96951 (8.8) is also being exploited