Exploited Windows and Ivanti Flaws: A Security Checklist for Small Businesses

Two security stories this week matter for any business that uses Windows PCs or a VPN. Neither needs panic, but both need action.

Check the sources: vulnerability details change quickly. Confirm current guidance in Microsoft's Security Update Guide, Ivanti's advisory and CISA's Known Exploited Vulnerabilities catalogue before you act.

What happened

• Windows: Microsoft's October updates include a fix for CVE-2026-96951, a "Mark of the Web" security-feature bypass that reports say was already being exploited. The US agency CISA told federal agencies to fix it by 16 October.
• Ivanti: On 13 October, Ivanti disclosed CVE-2026-104935, an authentication-bypass flaw in Connect Secure rated 8.6 out of 10, which attackers were exploiting against a limited number of customers. Researchers described a chain that could lead to command execution, and CISA added the flaw to its exploited-vulnerabilities list. At the time of reporting, a separate privilege-escalation flaw was still unpatched.

Why "Mark of the Web" matters

When you download a file from the internet, Windows tags it. That tag triggers extra warnings and protections before the file runs. A bypass means a malicious download may slip past those checks, so a single careless click becomes riskier. It is a good reminder that staff habits and updates both matter.

Why VPN flaws are serious

A VPN or remote-access gateway sits at the edge of your network. If an attacker gets past it, they may reach your internal systems, including your ERP, accounts and file shares.

A practical checklist

This week

1. Install the latest Windows and Office updates on every PC and server, and restart them.
2. Check whether you use Ivanti Connect Secure. If yes, follow Ivanti's current advice immediately and ask your IT provider to confirm every mitigation step.
3. List your internet-facing devices: VPNs, firewalls, routers, remote desktop servers and admin panels. Anything you forgot about is a risk.
4. Turn on multi-factor authentication for email, VPN, cloud tools and your ERP.
5. Remind staff not to open unexpected downloads, even from familiar names.

This month

• Keep an offline or immutable backup and test restoring from it.
• Give people only the access they need, and remove accounts of former staff and vendors.
• Turn on automatic updates wherever possible and set a patching routine, for example within seven days for critical fixes.
• Review logs and alerts for unusual logins, especially at night.
• Write a one-page incident plan with phone numbers, who decides, and who talks to customers.

For your website and apps

• Update your CMS, plugins and server software.
• Remove unused plugins and admin accounts.
• Use HTTPS, a web application firewall and rate limits on login pages.
• Check that your hosting provider takes regular backups.

When to call an expert

If you find anything suspicious, such as unknown admin accounts, strange outbound traffic or encrypted files, disconnect the device from the network and get professional help quickly. Do not wait to see whether it goes away.

How KalzTech can help

We help businesses harden websites, apps and Odoo ERP setups, including access controls, backups and update routines. If you would like a short security review of your web and ERP environment, contact our team.