The threat level is CRITICAL because newly reported active exploitation affects both Microsoft Windows and Ivanti Connect Secure, creating immediate exposure-review and remediation priorities for organizations using affected products. CVE-2026-96951 is reported as exploited in the wild and affects Windows Shell; CVE-2026-104935 is a pre-disclosure Ivanti Connect Secure authentication-bypass flaw that permits remote unauthenticated command execution and is reported to have affected a limited number of customers. The previous concerns for affected reachable AhsayCBS and N-central deployments remain material unless their exposure and remediation status have changed. Public exploitation signals remain distributed beyond a few CVEs: the leading five account for 0.252 of 115 30-day signal chains. Tool availability is broad—651 PoC/template observations and two functional-exploit observations in seven days—but no weaponization observations were recorded; mixed legacy measures cannot establish weaponization growth. First-party releases show six possible-CVE vulnerability-exploit findings, including payload activity, but no likely exploit attempts or successful exploitation. These findings are useful leads, not compromise confirmation. Organizations should urgently identify and remediate affected Windows and Ivanti assets, then investigate relevant indicators where exposure or suspicious activity exists.
Evidence window
13 Oct 2026, 06:26–14 Oct 2026, 06:26
Morning brief published
14 Oct 2026, 06:27
Assessment
URGENT
Standing assessment
Overall threat level: Critical
Moderate confidence
High confidence — Active-exploitation reports make affected Windows and Ivanti Connect Secure deployments immediate priorities.CVE-2026-96951 is reported exploited in the wild; CVE-2026-104935 was reportedly exploited before disclosure and enables remote unauthenticated command execution.
Moderate confidence — Known-exploited N-central and reported AhsayCBS risks remain material where affected deployments are reachable.No supplied evidence closes the previous assessments; current evidence does not establish their present customer exposure or exploitation scope.
Moderate confidence — Public exploitation concern remains distributed rather than dominated by a few CVEs.The five leading CVEs account for 0.252 of 115 public exploitation signal chains in the 30-day view.
High confidence — Tool availability is substantial, but available evidence does not establish weaponization growth.Seven-day evidence records 651 PoC/template and two functional-exploit observations, but zero weaponization observations; legacy metrics mix these categories.
High confidence — First-party findings are actionable leads but do not confirm exploitation or compromise.Six possible-CVE findings include payload activity and probes, while likely exploit attempts and unknown exploit-like activity are both zero.
Assessment confidenceIndependent public reporting supports active-exploitation concerns for Windows and Ivanti Connect Secure. First-party findings are non-confirmatory, and UNKNOWN collection comparability prevents attack-volume trend inference.
Standing analysis
What the evidence means
01
Attacks and available exploit tools
Public reporting identifies CVE-2026-96951 as exploited in the wild and describes CVE-2026-104935 as a pre-disclosure Ivanti Connect Secure flaw exploited against a limited number of customers. The Ivanti flaw permits remote unauthenticated command execution. The current seven-day corpus contains 651 PoC/template observations and two functional-exploit observations, with zero weaponization observations. Nuclei template coverage changed for CVE-2026-104935, showing tooling availability rather than observed exploitation in this environment. Legacy tooling and timing measures combine categories and cannot demonstrate weaponization growth or speed.
02
Attacker behavior
The reviewed first-party behavior sample contains six GENERIC_PROBE assessments, all with UNKNOWN opportunistic likelihood. This selected six-item sample cannot characterize all traffic. The six disclosed findings are possible-CVE vulnerability-exploit-intent associations: three HIGH and three MEDIUM confidence, with three payload-activity, two probe, and one unclassified evidence levels. They include strongly compatible associations for CVE-2024-24919, CVE-2024-4577, and CVE-2017-9841. A submitted payload or association does not establish target compatibility, execution, campaign scope, or compromise.
03
What VTP sensors observed
Six disclosure-safe finding releases require assessment. All are POSSIBLE_CVE findings, not unique attacks or CVEs; likely exploit attempts and unknown exploit-like activity are both zero. Consequently, they do not confirm successful exploitation. The 84 possibly attributed correlation groups are associations, while 22,627 unresolved groups are explicitly not unknown exploits. Sensor diversity, target compatibility, cross-product activity, and unique-attack counts are unavailable, limiting scope assessment.
04
Public reports and sensor evidence
The deterministic comparison records 45 reviewed sensor CVE associations: one overlaps a recent public signal and 44 do not. First-party daily releases contain six possible-CVE findings, none assessed as a likely exploit attempt. This is partial overlap at association level only. It neither confirms the public Windows or Ivanti exploitation reports nor contradicts them; no matching sensor observation is not evidence that exploitation is absent.
High confidence
04
What defenders can look for
Detection readiness is incomplete but does not itself evidence exploitation. The daily view identifies 106 potential operational gaps; in the 30-day signalled-CVE view, 12 operational gaps remain, with 40 remote cases unresolved for observability and detectability. One public trigger semantic is unavailable. Prioritize exposure identification and vendor remediation for affected Windows and Ivanti Connect Secure assets; where exposure or suspicious activity is present, investigate command-execution and other relevant compromise indicators. Maintain remediation or access restriction for affected reachable N-central and AhsayCBS deployments.
New warning signs
New public reporting identifies active exploitation affecting Windows (CVE-2026-96951) and pre-disclosure exploitation of Ivanti Connect Secure CVE-2026-104935.
Exploit-tooling coverage changed for CVE-2026-104935, but this demonstrates template availability rather than VTP-observed exploitation.
Six first-party possible-CVE findings include payload activity, but none is assessed as a likely exploit attempt or successful exploitation.
What we do not know
Historical collection denominators and replay or normalization changes are unavailable; signal-processing changes cannot establish attack-pressure trends.
First-party releases lack target-compatibility, execution, sensor-diversity, cross-product, and unique-attack metrics.
Technology classification covers 0.1217910447761194 of 1,675 CVEs; technology-specific distribution conclusions remain constrained.
What to watch next
Over the next 24–72 hours, the most defensible expectation is continued acute risk for exposed affected Windows and Ivanti Connect Secure deployments until remediation or mitigation is verified. Retained AhsayCBS and N-central concerns remain conditional on affected reachable deployments. No broader attack-pressure forecast is defensible because comparability is UNKNOWN.
Watch conditions
Escalate if affected reachable Windows or Ivanti Connect Secure deployments are identified without the applicable vendor remediation or compensating exposure restriction.
Escalate if telemetry establishes target compatibility and execution, or successful exploitation, for a current public exploitation signal.
Reassess immediately if new public or first-party evidence identifies compromise activity on affected AhsayCBS or N-central deployments.
Important changes since the last review
New active-exploitation reporting for CVE-2026-96951 raises the priority of affected Windows assets.
New reporting describes CVE-2026-104935 as a pre-disclosure exploited Ivanti Connect Secure authentication bypass permitting remote unauthenticated command execution.
Public concentration is modestly less concentrated: the leading five CVEs account for 0.252 of 115 chains, versus 0.271 of 107 previously.
First-party releases increased to six possible-CVE findings, including payload activity, without likely exploit-attempt or success evidence.
Recommended actions
Actions supported by this assessment
Identify affected Windows and Ivanti Connect Secure deployments, prioritize applicable vendor updates, and restrict exposure where timely remediation is not possible.
Investigate exposed affected Ivanti Connect Secure systems and relevant Windows systems for suspicious command execution or other compromise indicators.
Verify remediation or access restriction for affected reachable N-central and AhsayCBS deployments retained from the prior assessment.
Rapid7 Metasploit Framework added or changed exploit-oriented tooling for CVE-2026-27960. If you use OpenCTI 6.6.0 through 6.9.12, update to 6.9.13 or disable the default administrator while scheduling the update.
Rule-based activity matching: 84. 84 groups of sensor activity gained possible CVE matches from rules; 22627 had no possible CVE match.
Potential network detection gaps: 106. 106 CVEs with public exploitation evidence may leave network indicators, but VTP lacks a reviewed, active detection rule. This is a detection-readiness estimate, not observed exploitation. For 1035 remote CVEs, VTP has not determined whether network traffic can identify them. Another 9 cannot be reliably identified from network traffic alone. 5 new public reports remain unresolved.
Reports on the threats discussed
Relevant reports supplied with the morning assessment. Publication dates distinguish earlier context from new reporting.
CVE-2026-96951 has new reports of active exploitation during Microsoft's October updates. Identify affected Microsoft software and prioritize the applicable vendor update.
This earlier assessment still applies. Review in your environment: if you operate the named products, check whether your deployed versions are affected and look for reported signs of compromise where indicators are available. Checking sources and identifying the CVE remain VTP responsibilities. This recommendation does not establish that your systems are affected or compromised.