[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fONzcDNwZqUXGjK6DpdiIUZwbAdAVQi6Sdds8mVicdn8":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":21,"status":22,"created_at":23,"published_at":24,"article":25,"tags":29,"podcasts":42,"controls":43},"191cfe3c-5d84-4314-993a-2fe3e36ae5be","cisa-flags-actively-exploited-windows-and-ivanti-vulnerabilities-in-kev-catalog","246cb206-d376-400a-922c-c821098273a1","CISA Flags Actively Exploited Windows and Ivanti Vulnerabilities in KEV Catalog","Two critical vulnerabilities — a Microsoft Windows Command Injection flaw and an Ivanti Connect Secure Authentication Bypass — have been added to CISA's Known Exploited Vulnerabilities Catalog due to confirmed active exploitation in the wild. The root cause lies in delayed or absent patch management practices, where organizations fail to remediate publicly known vulnerabilities before threat actors can weaponize them. Authentication bypass vulnerabilities in remote access products like Ivanti are especially dangerous as they can grant attackers unauthenticated entry into corporate networks. The addition to the KEV Catalog under Binding Operational Directive 26-04 underscores that federal agencies — and by extension all organizations — must treat actively exploited vulnerabilities as emergency remediation priorities, not routine maintenance items.","**Immediate actions:**\n- Apply vendor-issued patches for CVE-2026-96951 (Microsoft Windows) and CVE-2026-104935 (Ivanti Connect Secure) to all affected systems immediately.\n- Audit all internet-facing assets running affected Microsoft Windows and Ivanti Connect Secure versions and prioritize them for emergency patching.\n- Temporarily restrict or disable external access to unpatched Ivanti Connect Secure instances until remediation is confirmed.\n\n**Long-term improvements:**\n- Subscribe to CISA's KEV Catalog feed and establish an SLA (e.g., 48–72 hours) for remediating any newly added exploited vulnerabilities on internet-exposed assets.\n- Maintain a continuously updated and accurate asset inventory to ensure no affected systems are overlooked during emergency patch cycles.\n- Implement network segmentation to isolate remote access gateways and VPN appliances from core internal infrastructure, limiting lateral movement if a breach occurs.\n\n**Detection measures:**\n- Deploy continuous vulnerability scanning tools (e.g., Tenable, Qualys) configured to flag KEV Catalog entries as critical-priority findings automatically.\n- Monitor authentication logs on Ivanti Connect Secure and Windows systems for anomalous access patterns, failed authentication bursts, or unexpected command execution events.\n- Integrate threat intelligence feeds into your SIEM to correlate indicators of compromise associated with active exploitation of these CVEs.",[12,13,14,15,16,17,18,19,20],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning","NIST SP 800-53 AC-17: Remote Access","NIST Cybersecurity Framework: ID.VM-1, RS.MI-3","CISA Binding Operational Directive (BOD) 26-04","ITIL: Change and Release Management (Emergency Change Process)","ISO\u002FIEC 27001: A.12.6.1 Management of Technical Vulnerabilities",{},"published","2026-10-13T22:21:58.249447+00:00","2026-10-13T22:21:58.221+00:00",{"id":7,"url":26,"slug":27,"title":28},"https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Falerts\u002F2026\u002F10\u002F13\u002Fcisa-adds-two-known-exploited-vulnerabilities-catalog","cisa-adds-two-known-exploited-vulnerabilities-to-catalog-897e03","CISA Adds Two Known Exploited Vulnerabilities to Catalog",[30,36],{"id":31,"name":32,"slug":33,"description":34,"color":35},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":37,"name":38,"slug":39,"description":40,"color":41},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[44,47,50],{"slug":33,"name":45,"problem":46},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":39,"name":48,"problem":49},"Automated patch management","Known holes get closed in days, not months.",{"slug":51,"name":52,"problem":53},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them."]