Cyber Security· Important
Two Actively Exploited Bugs Land on CISA's Must-Patch List
Attackers are already abusing a command injection flaw in Microsoft Windows (CVE-2026-96951) and an authentication bypass via spoofing in Ivanti Connect Secure (CVE-2026-104935), prompting CISA to add both to its Known Exploited Vulnerabilities catalog. Under Binding Operational Directive 26-04, federal civilian agencies must now fast-track fixes for internet-exposed systems that could be fully taken over through these flaws. CISA is also pushing all organizations, not just government ones, to adopt the same risk-based patching approach.