# KLM Innovation Security Monitor
**Date:** October 13, 2026

> Informational security guidance for awareness and prioritization. Not certification, legal advice, or a guarantee of protection.

## Executive Summary
Two exploited zero-days landed in CISA's KEV catalog on October 13th, both with an October 16th federal deadline: an Ivanti Connect Secure authentication bypass used for credential theft and data exfiltration, and a Windows Shell flaw that strips the Mark of the Web warning from crafted files. Patch Ivanti first, then hunt with memory forensics, because the vendor's integrity checker may miss in-memory activity and a third chained flaw is still unpatched. On the agent side, the day's research says the same thing four ways: LiteLLM gateway takeover and key theft, a Vercel Sandbox allowlist bypass, an over-scoped token in Mistral's coding sandbox, and 253 verified bugs across open-source MCP servers. Upgrade LiteLLM to 1.83.9 or later and stop trusting sandbox boundaries and model-generated tool arguments by default.

## Headline Developments

### 1. Ivanti Connect Secure zero-day CVE-2026-104935 exploited for credential theft, third chained flaw still unpatched (CRITICAL)
**Source:** [CISA - CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure](https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure) (October 13th)
- CVE-2026-104935 is an authentication bypass (CWE-290, CVSS 8.6) that lets a remote, unauthenticated attacker run arbitrary commands on Ivanti Connect Secure. Threat actors used it for credential theft and data exfiltration. It was added to KEV on October 13th.
- Affected: 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. Fixed: 25.1.1.2, 25.1.3.0/25.1.3.1 and 22.8R2.5. Versions 22.7.x and below aren't affected.
- Volexity tracks the actor as UTA0576. Exploitation began October 3rd on a fully patched 22.8R2.4 appliance and chained a third privilege-escalation flaw to reach root. That third flaw has no fix yet.
- Ivanti's Integrity Checker Tool may not detect this activity because the attacker's commands run in memory. Confirming compromise needs network and memory forensics.

**Why this matters:** CRITICAL because exploitation is active, it's unauthenticated, it reaches root through the chain, and attackers are already using it to steal credentials and data from a perimeter VPN. A clean integrity check isn't evidence of a clean box. Upgrade within hours, then hunt.

**Pattern callout:** Extends the edge-boundary thread (Citrix NetScaler CVE-2026-88779, October 5th): another perimeter gateway exploited before the patch reached every code line.

### 2. Windows Shell CVE-2026-96951 exploited to skip the Mark of the Web warning (HIGH)
**Source:** [Microsoft - CVE-2026-96951 Windows Shell Security Feature Bypass Vulnerability](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-96951) (October 13th)
- Command injection in Windows Shell lets an unauthorized attacker bypass a security feature over a network. Microsoft marks it exploited, and CISA added it to KEV on October 13th.
- Crafted files sent by email, instant message or a malicious site can skip the Mark of the Web warning. The user still has to open the file.
- The fix is in the October 13th cumulative updates, for example KB5127648 for Windows 11 24H2/25H2/26H2 and KB5126655 for Windows Server 2022.

**Why this matters:** HIGH because exploitation is confirmed and the flaw is on KEV. It needs user interaction and bypasses a warning rather than running code on its own, so it's below CRITICAL. Patch within 48 hours on anything that opens attachments.

**Pattern callout:** New thought today: attackers are going after the trust label on a file, not the file check itself.

### 3. LiteLLM CVE-2026-35029 and CVE-2026-59823: gateway takeover and provider key theft (MEDIUM)
**Source:** [Check Point - Check Point Research Discovers High Risk Vulnerabilities in LiteLLM](https://blog.checkpoint.com/security/check-point-research-discovers-high-risk-vulnerabilities-in-litellm-one-of-the-most-widely-used-llm-gateways/) (October 13th)
- CVE-2026-35029 let any authenticated user, including read-only users, reach admin functions and take over the gateway.
- CVE-2026-59823 is an SSRF that let a caller redirect the gateway's outbound requests and capture AI provider API keys.
- Researchers demonstrated full takeover, file access, credential theft and remote code execution in a test environment. Both are fixed in LiteLLM 1.83.9 and later.

**Why this matters:** MEDIUM because the CVEs and the fix are real and the attack is demonstrated, but there's no confirmed exploitation and neither CVE is on KEV. A gateway holds every provider key, so it's still worth fixing today.

**Pattern callout:** New CVE IDs in a product covered since September 16th (CVE-2026-59822 on KEV, default master key). The gateway stays the single point where all keys sit.

### 4. Agent sandboxes leak: Vercel allowlist bypass and an over-scoped Mistral token (CONTEXT)
**Source:** [The Record - Sandbox vulnerability gives rogue AI agents a path to escape and leak data](https://therecord.media/sandbox-vulnerability-gives-rogue-ai-agents-path-out) (October 13th)
- AIR found a Vercel Sandbox network-filtering flaw: a crafted certificate sent to an approved server could make that server fetch from an attacker-controlled host, moving data out without the sandbox ever contacting the attacker directly. There's no evidence of exploitation in the wild.
- Separately, a token present in Mistral's Le Chat coding sandbox reached firewalled internal services and the tool gateway, where the web-fetch tool became a server-side request primitive ([Vero Security - How a Leaked Token Exposed Mistral's Internal AI Models](https://www.vero.security/blog/your-agents-sandbox-isnt-private-how-one-token-opened-mistrals-internal-model-fleet), October 13th). It was reported to Mistral on August 31st.

**Why this matters:** CONTEXT because there's no CVE, no patch for customers to deploy and no exploitation. The lesson is architectural: allowlists and sandboxes are only as strong as what approved hosts and in-sandbox tokens can reach.

**Pattern callout:** Extends the default-permissions thread (September 20th onward) to the sandbox layer, after GitGuardian's token-on-disk case (October 12th).

### 5. ToFu: 253 verified bugs across 118 open-source MCP servers (CONTEXT)
**Source:** [arXiv - ToFu: Exploiting and Fuzzing the LLM-Orchestrator-Tool Trust Boundary](https://arxiv.org/html/2610.13651) (submitted October 9th)
- Fuzzing 273 servers with 3,405 tools produced 253 verified bugs in 343 tools across 118 servers: 115 reflected output, 64 path traversal, 58 log injection, 7 SSRF, 5 data exfiltration and 3 OS command injection.
- A "Repeat-After-Me" prompt pattern produced attacker-directed tool calls in six orchestration frameworks, including LangGraph, Google ADK 2.0, AutoGen and CrewAI ([GBHackers - Researchers Discover 253 Security Vulnerabilities Across 343 AI Agent Tools in MCP Servers](https://gbhackers.com/researchers-discover-253-security-vulnerabilities/), October 13th).
- It's a preprint with no CVEs assigned, and the counts are a floor.

**Why this matters:** CONTEXT because this is research without exploitation or patches. Tools should treat schema-valid, model-generated arguments as untrusted input.

**Pattern callout:** Extends the MCP scanner-evasion story (October 8th): that one was about malicious servers, this one is about honest servers that don't validate input.

## Continuity Footnotes
- GhostAction GitHub workflows: first reported October 10th; secondary coverage now cites more than 500 compromised accounts, no new primary information.
- Citrix NetScaler CVE-2026-88779: first reported October 5th; no new primary information.

## Pattern Analysis
1. **Edge boundary still open (September 17th to October 13th):** perimeter gateways exploited before patches reach every code line. Ivanti (Story 1, October 13th) follows Citrix (October 5th). Patch speed and memory forensics matter more than integrity checkers.
2. **Trust signals under attack (October 13th):** Windows Shell (Story 2) strips the "came from the internet" label, and Vercel's approved hosts become couriers (Story 4). Controls that rely on a label or an allowlist inherit its weakness.
3. **Default permissions are the blast radius (September 20th to October 13th):** LiteLLM read-only users reach admin (Story 3), a sandbox token reaches internal Mistral services (Story 4), and MCP tools accept any argument (Story 5).

## Recommended Actions
**Immediate (this week):**
1. Upgrade Ivanti Connect Secure to 22.8R2.5, 25.1.1.2 or 25.1.3.0/25.1.3.1 for CVE-2026-104935 (KEV due October 16th), then run network and memory forensics. Don't rely on the Integrity Checker alone.
2. Install the October 13th Windows cumulative updates for CVE-2026-96951 (KEV due October 16th) and confirm restarts.
3. Upgrade LiteLLM to 1.83.9 or later for CVE-2026-35029 and CVE-2026-59823, and rotate provider keys on any gateway that ran older versions with untrusted users.

**This month:**
4. Watch for Ivanti's fix for the third, privilege-escalation flaw and apply it on release.
5. Inventory what in-sandbox tokens and allowlisted hosts can reach, and scope both down.
6. Add argument validation between the model and every MCP tool: allowlist paths and hosts.

**Ongoing:**
7. Treat every model-generated tool argument as untrusted input.
8. Plan Ivanti 22.8 migration ahead of its January 31st, 2027 end of life.

## Relevant Risk Summary
| Risk | Severity | Recommended Actions |
|---|---|---|
| Ivanti Connect Secure CVE-2026-104935, exploited, KEV (due October 16th), third flaw unpatched | CRITICAL | Upgrade now; memory forensics |
| Windows Shell CVE-2026-96951, exploited, KEV (due October 16th) | HIGH | October 13th cumulative update |
| LiteLLM CVE-2026-35029 / CVE-2026-59823 | MEDIUM | Upgrade to 1.83.9+; rotate keys |
| Vercel Sandbox allowlist bypass; Mistral sandbox token | CONTEXT | Scope sandbox tokens and allowlists |
| ToFu: 253 MCP tool bugs (preprint) | CONTEXT | Validate tool arguments |

## Sources
- [CISA - CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure](https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure)
- [Rapid7 - Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)](https://www.rapid7.com/blog/post/etr-ivanti-connect-secure-zero-day-exploited-in-the-wild-cve-2026-104935/)
- [The Hacker News - Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far](https://thehackernews.com/2026/10/attacker-chains-three-ivanti-connect.html)
- [Microsoft - CVE-2026-96951 Windows Shell Security Feature Bypass Vulnerability](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-96951)
- [Action1 - Patch Tuesday October 2026](https://www.action1.com/patch-tuesday/patch-tuesday-october-2026/)
- [Check Point - Check Point Research Discovers High Risk Vulnerabilities in LiteLLM](https://blog.checkpoint.com/security/check-point-research-discovers-high-risk-vulnerabilities-in-litellm-one-of-the-most-widely-used-llm-gateways/)
- [The Record - Sandbox vulnerability gives rogue AI agents a path to escape and leak data](https://therecord.media/sandbox-vulnerability-gives-rogue-ai-agents-path-out)
- [Vero Security - How a Leaked Token Exposed Mistral's Internal AI Models](https://www.vero.security/blog/your-agents-sandbox-isnt-private-how-one-token-opened-mistrals-internal-model-fleet)
- [arXiv - ToFu: Exploiting and Fuzzing the LLM-Orchestrator-Tool Trust Boundary](https://arxiv.org/html/2610.13651)
- [GBHackers - Researchers Discover 253 Security Vulnerabilities Across 343 AI Agent Tools in MCP Servers](https://gbhackers.com/researchers-discover-253-security-vulnerabilities/)

*Informational security guidance. Not certification.*