Security Monitor 2026-10-13

Informational security guidance for awareness and prioritization. Not certification, legal advice, or a guarantee of protection.

Executive Summary

Two exploited zero-days landed in CISA's KEV catalog on October 13th, both with an October 16th federal deadline: an Ivanti Connect Secure authentication bypass used for credential theft and data exfiltration, and a Windows Shell flaw that strips the Mark of the Web warning from crafted files. Patch Ivanti first, then hunt with memory forensics, because the vendor's integrity checker may miss in-memory activity and a third chained flaw is still unpatched. On the agent side, the day's research says the same thing four ways: LiteLLM gateway takeover and key theft, a Vercel Sandbox allowlist bypass, an over-scoped token in Mistral's coding sandbox, and 253 verified bugs across open-source MCP servers. Upgrade LiteLLM to 1.83.9 or later and stop trusting sandbox boundaries and model-generated tool arguments by default.

Headline Developments

1. Ivanti Connect Secure zero-day CVE-2026-104935 exploited for credential theft, third chained flaw still unpatched CRITICAL

Source: CISA - CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure (October 13th)
- CVE-2026-104935 is an authentication bypass (CWE-290, CVSS 8.6) that lets a remote, unauthenticated attacker run arbitrary commands on Ivanti Connect Secure. Threat actors used it for credential theft and data exfiltration. It was added to KEV on October 13th.
- Affected: 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. Fixed: 25.1.1.2, 25.1.3.0/25.1.3.1 and 22.8R2.5. Versions 22.7.x and below aren't affected.
- Volexity tracks the actor as UTA0576. Exploitation began October 3rd on a fully patched 22.8R2.4 appliance and chained a third privilege-escalation flaw to reach root. That third flaw has no fix yet.
- Ivanti's Integrity Checker Tool may not detect this activity because the attacker's commands run in memory. Confirming compromise needs network and memory forensics.

Why this matters: CRITICAL because exploitation is active, it's unauthenticated, it reaches root through the chain, and attackers are already using it to steal credentials and data from a perimeter VPN. A clean integrity check isn't evidence of a clean box. Upgrade within hours, then hunt.

Pattern callout: Extends the edge-boundary thread (Citrix NetScaler CVE-2026-88779, October 5th): another perimeter gateway exploited before the patch reached every code line.

2. Windows Shell CVE-2026-96951 exploited to skip the Mark of the Web warning HIGH

Source: Microsoft - CVE-2026-96951 Windows Shell Security Feature Bypass Vulnerability (October 13th)
- Command injection in Windows Shell lets an unauthorized attacker bypass a security feature over a network. Microsoft marks it exploited, and CISA added it to KEV on October 13th.
- Crafted files sent by email, instant message or a malicious site can skip the Mark of the Web warning. The user still has to open the file.
- The fix is in the October 13th cumulative updates, for example KB5127648 for Windows 11 24H2/25H2/26H2 and KB5126655 for Windows Server 2022.

Why this matters: HIGH because exploitation is confirmed and the flaw is on KEV. It needs user interaction and bypasses a warning rather than running code on its own, so it's below CRITICAL. Patch within 48 hours on anything that opens attachments.

Pattern callout: New thought today: attackers are going after the trust label on a file, not the file check itself.

3. LiteLLM CVE-2026-35029 and CVE-2026-59823: gateway takeover and provider key theft MEDIUM

Source: Check Point - Check Point Research Discovers High Risk Vulnerabilities in LiteLLM (October 13th)
- CVE-2026-35029 let any authenticated user, including read-only users, reach admin functions and take over the gateway.
- CVE-2026-59823 is an SSRF that let a caller redirect the gateway's outbound requests and capture AI provider API keys.
- Researchers demonstrated full takeover, file access, credential theft and remote code execution in a test environment. Both are fixed in LiteLLM 1.83.9 and later.

Why this matters: MEDIUM because the CVEs and the fix are real and the attack is demonstrated, but there's no confirmed exploitation and neither CVE is on KEV. A gateway holds every provider key, so it's still worth fixing today.

Pattern callout: New CVE IDs in a product covered since September 16th (CVE-2026-59822 on KEV, default master key). The gateway stays the single point where all keys sit.

4. Agent sandboxes leak: Vercel allowlist bypass and an over-scoped Mistral token CONTEXT

Source: The Record - Sandbox vulnerability gives rogue AI agents a path to escape and leak data (October 13th)
- AIR found a Vercel Sandbox network-filtering flaw: a crafted certificate sent to an approved server could make that server fetch from an attacker-controlled host, moving data out without the sandbox ever contacting the attacker directly. There's no evidence of exploitation in the wild.
- Separately, a token present in Mistral's Le Chat coding sandbox reached firewalled internal services and the tool gateway, where the web-fetch tool became a server-side request primitive (Vero Security - How a Leaked Token Exposed Mistral's Internal AI Models, October 13th). It was reported to Mistral on August 31st.

Why this matters: CONTEXT because there's no CVE, no patch for customers to deploy and no exploitation. The lesson is architectural: allowlists and sandboxes are only as strong as what approved hosts and in-sandbox tokens can reach.

Pattern callout: Extends the default-permissions thread (September 20th onward) to the sandbox layer, after GitGuardian's token-on-disk case (October 12th).

5. ToFu: 253 verified bugs across 118 open-source MCP servers CONTEXT

Source: arXiv - ToFu: Exploiting and Fuzzing the LLM-Orchestrator-Tool Trust Boundary (submitted October 9th)
- Fuzzing 273 servers with 3,405 tools produced 253 verified bugs in 343 tools across 118 servers: 115 reflected output, 64 path traversal, 58 log injection, 7 SSRF, 5 data exfiltration and 3 OS command injection.
- A "Repeat-After-Me" prompt pattern produced attacker-directed tool calls in six orchestration frameworks, including LangGraph, Google ADK 2.0, AutoGen and CrewAI (GBHackers - Researchers Discover 253 Security Vulnerabilities Across 343 AI Agent Tools in MCP Servers, October 13th).
- It's a preprint with no CVEs assigned, and the counts are a floor.

Why this matters: CONTEXT because this is research without exploitation or patches. Tools should treat schema-valid, model-generated arguments as untrusted input.

Pattern callout: Extends the MCP scanner-evasion story (October 8th): that one was about malicious servers, this one is about honest servers that don't validate input.

Continuity Footnotes

• GhostAction GitHub workflows: first reported October 10th; secondary coverage now cites more than 500 compromised accounts, no new primary information.
• Citrix NetScaler CVE-2026-88779: first reported October 5th; no new primary information.

Pattern Analysis

1. Edge boundary still open (September 17th to October 13th): perimeter gateways exploited before patches reach every code line. Ivanti (Story 1, October 13th) follows Citrix (October 5th). Patch speed and memory forensics matter more than integrity checkers.
2. Trust signals under attack (October 13th): Windows Shell (Story 2) strips the "came from the internet" label, and Vercel's approved hosts become couriers (Story 4). Controls that rely on a label or an allowlist inherit its weakness.
3. Default permissions are the blast radius (September 20th to October 13th): LiteLLM read-only users reach admin (Story 3), a sandbox token reaches internal Mistral services (Story 4), and MCP tools accept any argument (Story 5).

Recommended Actions

Immediate (this week):
1. Upgrade Ivanti Connect Secure to 22.8R2.5, 25.1.1.2 or 25.1.3.0/25.1.3.1 for CVE-2026-104935 (KEV due October 16th), then run network and memory forensics. Don't rely on the Integrity Checker alone.
2. Install the October 13th Windows cumulative updates for CVE-2026-96951 (KEV due October 16th) and confirm restarts.
3. Upgrade LiteLLM to 1.83.9 or later for CVE-2026-35029 and CVE-2026-59823, and rotate provider keys on any gateway that ran older versions with untrusted users.

This month:
4. Watch for Ivanti's fix for the third, privilege-escalation flaw and apply it on release.
5. Inventory what in-sandbox tokens and allowlisted hosts can reach, and scope both down.
6. Add argument validation between the model and every MCP tool: allowlist paths and hosts.

Ongoing:
7. Treat every model-generated tool argument as untrusted input.
8. Plan Ivanti 22.8 migration ahead of its January 31st, 2027 end of life.

Relevant Risk Summary

Sources

• CISA - CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure
• Rapid7 - Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)
• The Hacker News - Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far
• Microsoft - CVE-2026-96951 Windows Shell Security Feature Bypass Vulnerability
• Action1 - Patch Tuesday October 2026
• Check Point - Check Point Research Discovers High Risk Vulnerabilities in LiteLLM
• The Record - Sandbox vulnerability gives rogue AI agents a path to escape and leak data
• Vero Security - How a Leaked Token Exposed Mistral's Internal AI Models
• arXiv - ToFu: Exploiting and Fuzzing the LLM-Orchestrator-Tool Trust Boundary
• GBHackers - Researchers Discover 253 Security Vulnerabilities Across 343 AI Agent Tools in MCP Servers

Informational security guidance. Not certification.