CISA has added two vulnerabilities to its Known Exploited Vulnerabilities catalog with a federal mitigation deadline of October 16, 2026. The entries cover a Microsoft Windows Shell command-injection vulnerability, CVE-2026-96951, and an Ivanti Connect Secure authentication-bypass vulnerability, CVE-2026-104935. [1]
The deadlines apply directly to U.S. federal civilian agencies, but the catalog is widely used by private-sector security teams as a signal for urgent review. Both entries require forensic triage under the catalog record, which means organizations should consider not only patching but also whether compromise may already have occurred.
The two catalog entries
CISA describes CVE-2026-96951 as a Microsoft Windows command-injection vulnerability that can allow an unauthorized attacker to bypass a security feature over a network. The catalog says it was added October 13 and carries an October 16 due date. [1]
The second entry, CVE-2026-104935, affects Ivanti Connect Secure. CISA describes it as an authentication-bypass-by-spoofing vulnerability that can allow a remote unauthenticated attacker to execute arbitrary commands. It carries the same add and due dates and also requires forensic triage. [1]
Microsoft’s October security release separately marks CVE-2026-96951 as having exploitation detected. [2] That alignment between the vendor security update and the KEV catalog raises the priority of confirming exposure and remediation.
Why patching alone is not enough
A patch reduces future exposure, but it does not prove that an attacker did not use the vulnerability before remediation. CISA’s forensic-triage requirement is therefore significant. Organizations should preserve relevant logs, review authentication and process activity, and follow their incident-response process if suspicious behavior appears.
The investigation should be proportionate and evidence-based. Not every affected asset has been compromised, but every affected asset should have an owner and a documented disposition. Internet exposure, privileged access, security telemetry, and the presence of sensitive data should influence the order of work.
What organizations should identify
For Windows, use endpoint and vulnerability-management tools to identify the affected versions and devices. Include remote endpoints, servers, virtual desktops, and machines that are not currently checking in. Confirm the installed update rather than relying only on an assigned policy.
For Ivanti Connect Secure, review appliances, versions, exposure, administrative access, and vendor mitigation guidance. Network teams should verify whether the appliance is reachable from the internet and whether logs are being retained in a system that an incident-response team can access.
If a system cannot be patched immediately, document the reason and apply available compensating controls. Do not treat isolation as a permanent substitute for remediation unless the business has formally accepted the risk.
A repeatable KEV process
Organizations should maintain a process that checks the KEV catalog, maps entries to asset inventory, assigns owners, sets deadlines, and verifies closure. The process should connect vulnerability data to identity, network exposure, and business service information.
A useful dashboard should show the affected asset, vulnerability, owner, exposure, mitigation, evidence of installation, and any remaining investigation. The security team should also be able to distinguish “not vulnerable,” “patched,” “isolated,” “retired,” and “under investigation.”
This level of detail avoids a common failure mode in which a ticket is marked complete because a patch was approved, even though the device never installed it or the replacement appliance remains exposed.
The business impact
CISA’s deadline is short because actively exploited vulnerabilities can move faster than ordinary change-management cycles. Leaders may need to approve emergency maintenance, temporary service restrictions, or accelerated replacement.
The neutral takeaway is that the KEV catalog is both a patching signal and an incident-readiness signal. Organizations should respond quickly, but they should also preserve evidence and confirm that the risk has actually been removed.
Guava Systems can help businesses review endpoint visibility, network exposure, remediation evidence, and Microsoft security operations without assuming that every environment has the same emergency path.
Sources
• [1] [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog), entries added October 13, 2026.
• [2] [October 2026 Security Updates — Microsoft MSRC](https://msrc.microsoft.com/update-guide/releaseNote/2026-Oct), October 14, 2026.
• [3] [CISA BOD 26-04 implementation guidance](https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk), accessed October 14, 2026.
