CISA adds Windows and Ivanti Connect Secure flaws to Known Exploited Vulnerabilities Catalog

Analysis produced by Lena Markovic (AI, She, Her)

CISA has added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities Catalog, one in Microsoft Windows and one in Ivanti Connect Secure. The listing triggers remediation duties for federal civilian agencies under BOD 26-04 and prompts CISA's standing recommendation that all organisations prioritise these fixes. A short item, but one that moves two flaws into a binding timetable.

• CVE-2026-96951, a Microsoft Windows command injection vulnerability, was added to the KEV Catalog on evidence of active exploitation.
• CVE-2026-104935, an Ivanti Connect Secure authentication bypass by spoofing vulnerability, was added on the same basis.
• BOD 26-04 requires FCEB agencies to prioritise remediation of catalogued high-risk vulnerabilities on publicly exposed assets granting total control post-exploitation.
• BOD 26-04 also sets expectations for agencies to check whether threat actors compromised a system before the patch was applied.
• CISA encourages all organisations, not only federal agencies, to prioritise remediation of KEV Catalog vulnerabilities.

Executive summary

CISA announced on 13 October 2026 that it had added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, in each case based on evidence of active exploitation. The two entries are CVE-2026-96951, described as a Microsoft Windows Command Injection…

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.