Two Actively Exploited Bugs Land on CISA's Must-Patch List
In short: Attackers are already abusing a command injection flaw in Microsoft Windows (CVE-2026-96951) and an authentication bypass via spoofing in Ivanti Connect Secure (CVE-2026-104935), prompting CISA to add both to its Known Exploited Vulnerabilities catalog. Under Binding Operational Directive 26-04, federal civilian agencies must now fast-track fixes for internet-exposed systems that could be fully taken over through these flaws. CISA is also pushing all organizations, not just government ones, to adopt the same risk-based patching approach.
This summary was generated automatically by AI from CISA Advisories's publication. It is our own text, not a copy of the original — facts, figures and quotes belong to the source, linked above and below.
What changed?
- 1CVE-2026-96951 — Microsoft Windows command injection, confirmed exploited in the wild
- 2CVE-2026-104935 — Ivanti Connect Secure authentication bypass via spoofing, confirmed exploited in the wild
- 3Both now listed in CISA's KEV catalog, triggering mandatory remediation timelines for federal agencies under BOD 26-04
- 4BOD 26-04 also requires agencies to check for prior compromise before patches are applied on affected assets
Why it matters
Windows systems and Ivanti Connect Secure gateways are widely deployed across enterprise and remote-access infrastructure, so active exploitation of these two flaws creates a real window for attackers to gain footholds or bypass authentication on exposed networks.
What it means for AI agents and contact centers
If any servers, VPN endpoints or remote-access gateways running Windows or Ivanti Connect Secure are exposed to the internet, check them against these two CVEs immediately and patch or isolate them before verifying no prior compromise occurred.
Sources
- CISA AdvisoriesOfficialPrimary sourceOriginal article →„CISA Adds Two Known Exploited Vulnerabilities to Catalog“13 Oct 2026, 15:00Licence: US federal government work (17 U.S.C. §105) · our summary (content changed)
- Published by source
- 13 Oct 2026, 15:00
- Found by our system
- 13 Oct 2026, 23:41
- Summary generated
- 13 Oct 2026, 23:42
This article was written by AI from the original source. Facts, numbers and prices come from the source; missing values are marked “Not specified”. Legal notice, copyright and privacy