Two Exploited Flaws, One Short Clock: Windows and Ivanti on the KEV List

Two flaws, one listing day

The Cybersecurity and Infrastructure Security Agency (CISA) keeps a public warning list. The list is the Known Exploited Vulnerabilities (KEV) catalog.

On October 13, 2026, CISA added two flaws to that catalog. CISA added them based on evidence of active use. The CISA alert names both flaws in one notice (CISA).

One flaw sits in Microsoft Windows. The other sits in a Virtual Private Network (VPN) gateway. Both flaws had a federal due date of October 16, 2026.

The Windows flaw

The Common Vulnerabilities and Exposures record is CVE-2026-96951.

The record calls it a command injection flaw in Windows Shell. Command injection means bad input becomes a system command. The weakness class is Common Weakness Enumeration 77.

The Common Vulnerability Scoring System score is 8.8, High. A remote attacker needs no login for this flaw. The victim must still open or follow crafted content.

Microsoft says the flaw can bypass a security feature. That feature is Mark of the Web. Windows tags files that arrive from the internet. The tag triggers warnings in apps like Office.

If the tag is bypassed, warnings can be skipped. A crafted file can then look local and trusted. Microsoft addressed the flaw in its October updates.

The Ivanti flaw

The second record is CVE-2026-104935.

The record calls it authentication bypass by spoofing. Authentication bypass means the login check fails. Spoofing means the attacker fakes a trusted signal.

The product is Ivanti Connect Secure (ICS). ICS is a VPN gateway at the network edge. The score is 8.6, High, in the record.

A remote attacker needs no login here either. The attacker can run arbitrary commands on the appliance. CISA says attackers used it for credential theft. CISA also says attackers used it for data exfiltration.

Affected builds include 25.1.1.1 and prior builds. Affected builds also include 25.1.2.2 and prior builds. The 22.8R2.4 and prior builds are affected too.

Builds at 22.7R2.14 or prior are not affected. Fixed builds include 25.1.1.2 and 22.8R2.5. Fixed builds also include 25.1.3.0 and 25.1.3.1.

Ivanti disclosed the flaw on October 13, 2026. Ivanti said exploitation hit a limited number of customers. Volexity observed exploitation from October 3, 2026. Defused observed activity from October 1, 2026.

Why the checker warning matters

CISA gave a clear warning on detection. The Ivanti Integrity Checker Tool may miss this flaw.

CISA says attacker commands execute in memory. Memory only activity can leave little on disk. A clean checker result is not proof of safety.

CISA urges network and memory forensics instead. If compromise is suspected, CISA advises a factory reset. CISA also advises an upgrade after that reset.

CISA then advises resetting account passwords. It also advises reissuing stored certificates. Stored application programming interface keys need reset too.

The governance lesson

A KEV listing changes a patch from routine to urgent. The listing says attackers already use the flaw. Waiting for a normal patch window invites risk.

The record you keep should show four facts. It should name each affected asset you own. It should record the fixed version you installed. It should record the date you installed it. It should record how you checked prior use.

That last fact is the one teams skip. Patching closes a door for future attacks. It does not prove nobody used the door before.

PolicyCortex does not patch Windows or Ivanti products. Microsoft and Ivanti ship those fixes themselves. PolicyCortex helps teams collect live patch evidence.

Azure Government and Government Community Cloud High remain roadmap items. They are not shipping PolicyCortex targets today.

What to do this week

List every Windows system in your boundary. List every ICS gateway in your boundary. Match each system against the affected builds above.

Install the vendor fix for each affected system. Then run the compromise check CISA describes. Save the patch record and the check record together.

Sources

• CVE-2026-96951 record, CVE Program. Updated October 21, 2026.
• CVE-2026-104935 record, CVE Program. Updated October 13, 2026.
• CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure, CISA, October 13, 2026. https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure
• CVE-2026-104935 detail, National Vulnerability Database. KEV due date October 16, 2026.
• CISA Known Exploited Vulnerabilities Catalog, CISA. https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Ivanti Security Advisory for Connect Secure, linked from the CISA alert for CVE-2026-104935.
• Microsoft Security Update Guide entry for CVE-2026-96951, linked from its CVE record as the vendor advisory.
• Original diagram by PolicyCortex.

Next step

Want KEV patch evidence collected on a schedule, not by spreadsheet? See how PolicyCortex reads it from the live tenant.