CISA Flags Actively Exploited Windows and Ivanti Vulnerabilities in KEV Catalog
Two critical vulnerabilities — a Microsoft Windows Command Injection flaw and an Ivanti Connect Secure Authentication Bypass — have been added to CISA's Known Exploited Vulnerabilities Catalog due to confirmed active exploitation in the wild. The root cause lies in delayed or absent patch management practices, where organizations fail to remediate publicly known vulnerabilities before threat actors can weaponize them. Authentication bypass vulnerabilities in remote access products like Ivanti are especially dangerous as they can grant attackers unauthenticated entry into corporate networks. The addition to the KEV Catalog under Binding Operational Directive 26-04 underscores that federal agencies — and by extension all organizations — must treat actively exploited vulnerabilities as emergency remediation priorities, not routine maintenance items.
Tactical Insight
Immediate actions
- Apply vendor-issued patches for CVE-2026-96951 (Microsoft Windows) and CVE-2026-104935 (Ivanti Connect Secure) to all affected systems immediately.
- Audit all internet-facing assets running affected Microsoft Windows and Ivanti Connect Secure versions and prioritize them for emergency patching.
- Temporarily restrict or disable external access to unpatched Ivanti Connect Secure instances until remediation is confirmed.
Long-term improvements
- Subscribe to CISA's KEV Catalog feed and establish an SLA (e.g., 48–72 hours) for remediating any newly added exploited vulnerabilities on internet-exposed assets.
- Maintain a continuously updated and accurate asset inventory to ensure no affected systems are overlooked during emergency patch cycles.
- Implement network segmentation to isolate remote access gateways and VPN appliances from core internal infrastructure, limiting lateral movement if a breach occurs.
Detection measures
- Deploy continuous vulnerability scanning tools (e.g., Tenable, Qualys) configured to flag KEV Catalog entries as critical-priority findings automatically.
- Monitor authentication logs on Ivanti Connect Secure and Windows systems for anomalous access patterns, failed authentication bursts, or unexpected command execution events.
- Integrate threat intelligence feeds into your SIEM to correlate indicators of compromise associated with active exploitation of these CVEs.