CISA adds two actively exploited flaws to its KEV Catalog: Windows and Ivanti

CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog on October 13, 2026, based on evidence that both are being actively exploited in the wild. The entries are CVE-2026-96951, a command injection flaw in Microsoft Windows, and CVE-2026-104935, an authentication bypass by spoofing in Ivanti Connect Secure.

According to CISA, these types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.

What the two entries cover

The catalog now lists a Windows command injection issue and an Ivanti Connect Secure authentication bypass that works through spoofing. CISA did not publish severity scores, affected version numbers or patch details in the alert — the agency’s notice is limited to naming the two CVEs and confirming exploitation evidence.

Ivanti Connect Secure is a remote-access VPN appliance, which puts it on the public internet by design, and authentication bypasses there can hand an attacker a foothold without valid credentials. Windows command injection, meanwhile, is a class of flaw that can let an attacker run their own commands on a target system.

What federal agencies are now required to do

The additions land under Binding Operational Directive (BOD) 26-04, which CISA describes as establishing vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. The directive reinforces the KEV Catalog and requires agencies to prioritize rapid remediation of high-risk vulnerabilities — specifically CVEs listed in the catalog on publicly exposed assets that grant total control of the asset after exploitation — while deferring action on lower-risk ones.

BOD 26-04 also sets basic expectations for when agencies must check whether threat actors compromised a system before the patch was applied, CISA said.

The directive applies only to FCEB agencies, but CISA encourages all organizations to adopt risk-based vulnerability management and to prioritize remediation of KEV Catalog vulnerabilities. The agency said it will keep adding vulnerabilities that meet its criteria.

How to nominate a vulnerability

If you are aware of an exploited vulnerability that is not yet in the catalog, CISA accepts submissions through its KEV Nomination Form. Potential additions must include a CVE ID, evidence of exploitation and clear mitigation guidance.

For anyone running Ivanti Connect Secure or Windows systems in a public-facing role, the practical step is to check the KEV Catalog entry for each CVE and apply the vendor’s mitigation guidance — and, per the directive’s framing, verify whether the system was compromised before patching.

Sources

• CISA Adds Two Known Exploited Vulnerabilities to Catalog — CISA Advisories