Threat reportVulnerabilityTL-2026-3456
CISA KEV Adds Two Vulnerabilities: Microsoft Windows Shell Command Injection (CVE-2026-96951) and Ivanti Connect Secure Authentication Bypass by Spoofing (CVE-2026-104935)
CISA KEV Adds Two Vulnerabilities (TL-2026-3456) is a critical-severity software vulnerability scored CVSS 8.8, first published 2026-10-14. It has no confirmed attribution, affects Microsoft Windows, references 2 CVEs (CVE-2026-96951, CVE-2026-104935), maps to 15 MITRE ATT&CK techniques (T1059, T1133, T1189), and is covered by 9 detection rules and 28 indicators of compromise.
- CVSS
- 8.8/10Critical
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 15MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 28Indicators of compromise
Key facts for TL-2026-3456
- Threat ID
- TL-2026-3456
- Severity
- CRITICAL
- CVSS
- 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, technology, enterprise
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 28
- Updates
- 2026-10-14 · 3 updates · revalidated 3× · latest source
Malware and tooling in CISA KEV Adds Two Vulnerabilities
Malware and tooling: Windows10
How CISA KEV Adds Two Vulnerabilities works
On 2026-10-13 CISA added two actively exploited vulnerabilities to the KEV catalog: a Microsoft Windows Shell command injection flaw (CVE-2026-96951) that allows a security feature bypass over a network, and an Ivanti Connect Secure authentication bypass by spoofing flaw (CVE-2026-104935) that allows remote unauthenticated arbitrary command execution. The KEV catalog lists a due date of 2026-10-16 under BOD 26-04.
CISA added two vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog on 2026-10-13, citing evidence of active exploitation. CISA notes these vulnerability types are a frequent attack vector for malicious cyber actors and directs Federal Civilian Executive Branch agencies to BOD 26-04, which requires rapid remediation of high-risk KEV vulnerabilities, particularly on publicly exposed assets. The CISA alert itself states no due date; the KEV catalog entry for CVE-2026-104935 lists a due date of 2026-10-16 with the required action to apply mitigations per vendor instructions in compliance with BOD 26-04 (evaluate internet exposure, follow patching timelines, or discontinue the product if fixes are unavailable) and notes forensic triage is required. Ransomware use is listed as Unknown for that entry.
CVE-2026-96951 (Microsoft Windows Shell command injection, CWE-77): per the NVD record, improper neutralization of special elements used in a command in Windows Shell allows an unauthorized attacker to bypass a security feature over a network. NVD scores it 8.8 HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning network-reachable, low complexity, no privileges, and user interaction required. Affected products listed: Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), Windows Server 2012 R2, 2016, 2019, 2022 and 2025, plus the Outlook.com service (builds before 20260925.100). The Microsoft MSRC guide is the vendor reference; its page could not be rendered during research, so KB numbers and fixed build numbers are not recorded here.
CVE-2026-104935 (Ivanti Connect Secure authentication bypass by spoofing, CWE-290): per the NVD record, authentication bypass by spoofing in Ivanti Connect Secure (ICS) before 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. NVD scores it 8.6 HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L: network, low complexity, no privileges, no user interaction). Affected: ICS 25.1.0.0 through 25.1.1.1, 25.1.2.x and 22.8R2 through 22.8R2.4; fixed in 25.1.3.0 and 22.8R2.5 and later; 22.7R2.14 and earlier is stated as not affected. The Ivanti advisory page could not be rendered during research, so Ivanti-published mitigations and indicators of compromise were not retrieved.
No threat actor, campaign, malware, C2 infrastructure, file hashes or network indicators are stated in the CISA alert, KEV entries or NVD records, so none are recorded; attribution is Unknown. Web searches found no public reporting specific to either CVE beyond these records. Because no network IOCs exist, no BeaconBeagle correlation was possible. The IOC list is therefore limited to affected-product and version identifiers useful for asset exposure matching. Defenders should treat internet-facing Ivanti Connect Secure appliances as the highest-priority exposure, apply vendor patches or mitigations, and follow Ivanti's integrity-check and forensic guidance since exploitation is confirmed.
MITRE ATT&CK techniques used in TL-2026-3456
Execution
T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution; T1204 User Execution; T1204.001 User Execution; T1204.002 User Execution
Initial Access
T1133 External Remote Services; T1189 Drive-by Compromise; T1190 Exploit Public-Facing Application; T1566 Phishing; T1566.001 Phishing; T1566.002 Phishing; T1566.003 Phishing
Defense Evasion
T1211 Exploitation for Defense Evasion; T1553.005 Subvert Trust Controls
defense-impairment
Affected products and versions in CISA KEV Adds Two Vulnerabilities
- Microsoft — Windows
Vulnerable versions: Windows 10 1607; Windows 10 1809; Windows 10 21H2; Windows 10 22H2; Windows 11 23H2; Windows 11 24H2; Windows 11 25H2; Windows 11 26H1; Windows 11 26H2; Windows Server 2012 R2
Fixed in: See MSRC Update Guide for CVE-2026-96951 (KB numbers not retrieved) - Microsoft — Outlook.com
Vulnerable versions: Builds before 20260925.100
Fixed in: 20260925.100 - Ivanti — Connect Secure
Vulnerable versions: 25.1.0.0 through 25.1.1.1; 25.1.2.0 through 25.1.2.x; 22.8R2 through 22.8R2.4
Fixed in: 25.1.3.0 and later; 22.8R2.5 and later
Remediation for CISA KEV Adds Two Vulnerabilities
Patches
- Ivanti Connect Secure 25.1.3.0 or later
- Ivanti Connect Secure 22.8R2.5 or later
- Microsoft security update for CVE-2026-96951 per the MSRC Update Guide for the affected Windows 10, Windows 11 and Windows Server builds
- Outlook.com service is fixed at build 20260925.100 or later (service-side)
Immediate actions
- Apply vendor mitigations per CISA BOD 26-04 by the 2026-10-16 KEV due date; discontinue use of the product if mitigations are unavailable
- Prioritize internet-facing Ivanti Connect Secure appliances and any publicly exposed Windows assets
- Perform forensic triage on exposed assets as required by BOD 26-04 before and after patching
- Inventory Ivanti Connect Secure versions 25.1.0.0-25.1.2.x and 22.8R2 through R2.4
Workarounds
- Follow vendor mitigation instructions in the Ivanti advisory and MSRC guidance where patching is not yet possible
- Restrict network access to Connect Secure management and portal interfaces to trusted sources until patched
Longer-term hardening
- Reduce internet exposure of VPN gateways and management interfaces
- Monitor the CISA KEV catalog and subscribe to Ivanti and Microsoft security advisories
- Deploy EDR and log process-creation telemetry on Windows endpoints and gateway integrity monitoring
CVEs associated with CISA KEV Adds Two Vulnerabilities
Weaknesses (CWE) in CISA KEV Adds Two Vulnerabilities
Timeline of CISA KEV Adds Two Vulnerabilities
- Microsoft patches CVE-2026-21510, an earlier exploited Windows Shell security feature bypass (SmartScreen bypass via crafted links or shortcuts), establishing a recurring Shell bypass pattern in 2026.
- Outlook.com service build 20260925.100 is the first build not affected by CVE-2026-96951 per the NVD record (build identifier date).
- Microsoft releases October 2026 Patch Tuesday fixes for CVE-2026-96951 (Important, 'Exploitation Detected'); the flaw was not publicly disclosed before the update, making it a zero-day. Windows Server 2012 receives no patch.
- KEV entry for CVE-2026-104935 requires forensic triage under BOD 26-04 and lists ransomware use as Unknown.
- CISA publishes the alert 'CISA Adds Two Known Exploited Vulnerabilities to Catalog' and references BOD 26-04 for remediation of high-risk vulnerabilities on exposed assets.
- CISA adds CVE-2026-96951 and CVE-2026-104935 to the Known Exploited Vulnerabilities catalog on evidence of active exploitation.
- NVD publishes CVE-2026-104935, an Ivanti Connect Secure authentication bypass by spoofing (CWE-290) allowing unauthenticated arbitrary command execution, CVSS 8.6; fixes in ICS 25.1.3.0 and 22.8R2.5.
- NVD publishes CVE-2026-96951, a Windows Shell command injection (CWE-77) enabling a network security feature bypass, CVSS 8.8.
- Media outlets report the Windows Shell zero-day as actively exploited via crafted files bypassing Mark of the Web; the flaw is not zero-click and needs user interaction.
- CISA KEV due date for applying mitigations to the added vulnerabilities under BOD 26-04 (listed on the CVE-2026-104935 KEV entry).
Update history for TL-2026-3456
- 2026-10-14 — Microsoft Windows Shell Command Injection / Mark of the Web Bypass (CVE-2026-96951) Exploited in the Wild, Added to CISA KEV: What changed No field escalation: severity (CRITICAL), exploitability (ACTIVE) and status (ACTIVE) already match the newer report. New indicators (5) 5 additional patch KB identifiers for CVE-2026-96951 (KB5126646 for Windows Server 2025 wi
- 2026-10-14 — Windows Shell Zero-Day (CVE-2026-96951) Bypasses Mark of the Web Protections: What changed No severity, exploitability or status change. The existing record (CRITICAL / ACTIVE) already meets or exceeds the newer report (HIGH / ACTIVE), and nothing was downgraded. New indicators (6) Two additional patch KBs (KB5126653
- 2026-10-14 — Microsoft Windows Shell Zero-Day Security Feature Bypass (CVE-2026-96951) Actively Exploited: What changed No field escalation: severity, exploitability, CVSS and status already match or exceed the newer report (which rates HIGH; no downgrade applied). Adds vendor-side detail for CVE-2026-96951: the bypassed feature is Mark of the W
Sources cited for CISA KEV Adds Two Vulnerabilities
- CISA Alert: CISA Adds Two Known Exploited Vulnerabilities to Catalog
- CISA KEV Catalog Entry: CVE-2026-96951 (Microsoft Windows Command Injection)
- CISA KEV Catalog Entry: CVE-2026-104935 (Ivanti Connect Secure Authentication Bypass by Spoofing)
- CISA BOD 26-04 Implementation Guidance: Prioritizing Security Updates Based on Risk
- Microsoft MSRC Update Guide: CVE-2026-96951
- Ivanti Security Advisory: Ivanti Connect Secure CVE-2026-104935
- NVD: CVE-2026-96951
- NVD: CVE-2026-104935
- CVE Record CVE-2026-96951
- CVE Record CVE-2026-104935
Detection coverage for TL-2026-3456
As of 2026-10-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3456 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.