Zero-Day Watch
Updated October 22, 2026. 3 of 5 entries are under confirmed active exploitation; the rest are publicly disclosed with no exploitation observed.
| Vulnerability | Criticality | Affected product | Who is exposed | India status & sources |
|---|---|---|---|---|
| CVE-2026-104935 Authentication bypass allowing remote unauthenticated command execution on the VPN appliance itself | Exploited CVSS 8.6 — High Actively exploited before disclosure; added to CISA KEV on the day of vendor disclosure | Ivanti Connect Secure — 22.8R2.4 and earlier, 25.1.1.1 and earlier, 25.1.2.2 and earlier | Remote-access VPN concentrators sit at the network edge and terminate employee sessions, so a compromise is an authenticated foothold rather than a single host. Heaviest exposure where Connect Secure is the standard remote-access tier: GCCs, IT services, BFSI back offices and government departments. | No CERT-In advisory located at time of writing. Exploitation is confirmed globally; no India-specific victim set has been disclosed. Ivanti advisory · CISA KEV · Rapid7 · BleepingComputer (Oct 2026) |
| CVE-2026-85102 Pre-authentication remote code execution in VPN certificate handling | Exploited Pre-auth RCE — vendor CVSS not published Exploitation wave observed from September 12, 2026; CISA set a federal remediation deadline of September 25 | Check Point Security Gateway — R81.20, R82, R82.10 (LivePatch Take 26); earlier builds need specific Jumbo Hotfixes. Spark appliances targeted first. | Perimeter firewalls. Pre-auth means no credential is required, so anything reachable from the internet is in scope. Spark is a small-and-mid-business line, which pushes exposure well beyond large enterprises into mid-market and branch deployments. | No CERT-In advisory located. First public alert came from the Dutch NCSC; attackers used VPNs and proxies to obscure origin, so no geography of victims has been published. Check Point advisory · Dutch NCSC · CISA · BleepingComputer (Sep 2026) |
| CVE-2026-96951 Command injection in Windows Shell that bypasses Mark of the Web | Exploited Security feature bypass — Microsoft published no CVSS Confirmed exploited in the wild; the priority item in October Patch Tuesday | Windows Shell — see Microsoft's October 2026 Patch Tuesday (1,411 flaws, 70 rated Critical, 57 of those RCE) | Mark of the Web is the warning banner on files arriving from the internet or email. Bypassing it turns a downloaded attachment into a silent execution path, so the exposure is every Windows endpoint — the broadest surface on this list, and the one that depends on end-user behaviour rather than an exposed service. | No CERT-In advisory located. Applies to any Windows estate; no India-specific exploitation has been reported. Microsoft October 2026 Patch Tuesday · BleepingComputer · Dark Reading |
| CVE-2026-108398 Bypass of Windows Defender Application Control, executing code inside protected processes | Disclosed Security feature bypass — no CVSS published Publicly disclosed, no observed exploitation. Reported by James Forshaw, Google Project Zero | .NET Framework | Estates that rely on WDAC application allow-listing as a primary control — common in regulated environments: banking endpoints, payment operations and government desktops. Requires an authenticated attacker, so it is an escalation tool, not an entry point. | No CERT-In advisory located. No exploitation observed anywhere at time of writing. Microsoft October 2026 Patch Tuesday · Google Project Zero |
| CVE-2026-92707 Uncontrolled sequential memory allocation enabling remote denial of service | Disclosed Denial of service — no CVSS published Publicly disclosed, no observed exploitation | MessagePack-CSharp (.NET serialisation library) | A dependency-chain item rather than a product one: it reaches anything that deserialises MessagePack from an untrusted source, typically internal APIs and game or real-time backends. Availability impact only — no code execution, no data access. | No CERT-In advisory located. Listed here as a dependency-tree item worth an inventory check, not an incident. Microsoft October 2026 Patch Tuesday · BleepingComputer |
Criticality ranks observed exploitation above raw CVSS: a flaw under active attack outranks a higher-scored one with no observed exploitation. An India status of “no CERT-In advisory located” means exactly that — a global advisory is never restated as an India-specific finding.