CVE‑2026‑96951 & CVE‑2026‑104935 Added to CISA KEV Catalog – Windows Command Injection & Ivanti Auth‑Bypass Demand Immediate Patch Management
What It Is — CISA announced that two vulnerabilities—CVE‑2026‑96951 (Microsoft Windows command‑injection) and CVE‑2026‑104935 (Ivanti Connect Secure authentication bypass via spoofing)—have been placed in the Known Exploited Vulnerabilities (KEV) catalog after verification of active exploitation.
Exploitability — Both flaws are confirmed to be weaponised in the wild; CVSS scores are publicly disclosed as high (≥7.5). No public exploit code is required, and attackers can gain full control of affected systems.
Affected Products —
- Microsoft Windows operating system (specific versions disclosed in the vendor advisory).
- Ivanti Connect Secure VPN appliance.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous vulnerability‑management controls that can surface high‑risk flaws in near‑real time.
- Provides audit‑ready evidence that an organization is prioritising remediation of known‑exploited issues, a key trust signal for regulators and enterprise buyers.
- Highlights the importance of evidence collection (patch status, remediation tickets) to prove due‑diligence during assessments.
Recommended Actions
- Cross‑reference your asset inventory against the two CVE IDs; flag any Windows hosts or Ivanti Connect Secure instances.
- Prioritise patching or mitigation per the vendor’s guidance; document the work in your change‑management system.
- Capture remediation evidence (patch logs, configuration snapshots) and map it to your control‑objective for vulnerability management.
- Review your risk‑based patch‑prioritisation process (e.g., NIST CSF Identify → Risk Management) to ensure KEV‑catalog items receive accelerated handling.
Source: CISA Advisory – 13 Oct 2026