CISA Adds Two Actively Exploited Vulnerabilities to KEV Catalog
Summary
CISA added actively exploited Microsoft Windows command injection and Ivanti Connect Secure authentication-bypass vulnerabilities to its KEV Catalog, urging organizations to prioritize remediation.
Key points
- The KEV additions are CVE-2026-96951, a Microsoft Windows command injection vulnerability, and CVE-2026-104935, an Ivanti Connect Secure authentication-bypass-by-spoofing vulnerability.
- CISA says the additions are based on evidence of active exploitation.
- Federal agencies must prioritize remediation of qualifying KEV vulnerabilities under BOD 26-04 and check for possible compromise before patching.
- CISA encourages all organizations to use risk-based vulnerability management and prioritize remediation of KEV-listed vulnerabilities.
Article Details
- Vulnerability Types
- Command injection
- Authentication bypass by spoofing
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- unknown