The US Cybersecurity and Infrastructure Security Agency (CISA) said on 13 October 2026 that it added two flaws to its Known Exploited Vulnerabilities (KEV) Catalog. The agency says it has evidence that attackers are using both. One is CVE-2026-96951, a command injection flaw in Microsoft Windows. The other is CVE-2026-104935, an Ivanti Connect Secure flaw that lets an attacker get past authentication by spoofing.
CISA's notice gives no technical detail on either flaw. It does not say which Windows versions or Ivanti releases are affected. It does not name the attackers, say how many systems are hit, or describe the fixes. It also sets no patch deadline in this notice. CISA says flaws of this kind are a frequent route for attacks and carry real risk for the federal enterprise.
The notice ties the additions to Binding Operational Directive 26-04, which governs US federal civilian agencies. It tells them to fix listed flaws first on internet-facing assets where an attacker would gain full control. It also sets expectations for checking whether a system was breached before patching. CISA says only federal agencies are bound by this rule, but it urges all organisations to follow it. Teams that run Windows or Ivanti Connect Secure have a clear reason to check their patch status now.