Government Advisory

CISA Flags Actively Exploited Flaws in Windows and Ivanti Connect Secure

CISA · 13 Oct 2026

Key Takeaway Check whether you run Windows or Ivanti Connect Secure, apply the relevant updates as a priority, and use the KEV Catalog to decide which patches to tackle first.

The US Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence that attackers are already using them. The first is CVE-2026-96951, a command injection vulnerability in Microsoft Windows. The second is CVE-2026-104935, an authentication bypass by spoofing vulnerability in Ivanti Connect Secure.

CISA notes that these types of vulnerabilities are a frequent attack vector for malicious cyber actors. Its Binding Operational Directive 26-04 requires US federal agencies to prioritise rapid fixes for KEV-listed flaws on publicly exposed systems that give an attacker total control once exploited. It also sets expectations for checking whether a system was compromised before the patch was applied.

The directive applies only to US federal agencies. However, CISA encourages all organisations to adopt risk-based vulnerability management and to prioritise fixing KEV Catalog vulnerabilities.

CISA KEV Microsoft Windows Ivanti Connect Secure Patch management

Summarised by CISO AI from CISA, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.