# CISA KEV Adds Two Vulnerabilities: Microsoft Windows Shell Command Injection (CVE-2026-96951) and Ivanti Connect Secure Authentication Bypass by Spoofing (CVE-2026-104935)

> On 2026-10-13 CISA added two actively exploited vulnerabilities to the KEV catalog: a Microsoft Windows Shell command injection flaw (CVE-2026-96951) that allows a security feature bypass over a network, and an Ivanti Connect Secure authentication bypass by spoofing flaw (CVE-2026-104935) that allows remote unauthenticated arbitrary command execution. The KEV catalog lists a due date of 2026-10-16 under BOD 26-04.

- **Published:** 2026-10-14T03:32:21Z
- **Last reviewed:** 2026-10-14T22:46:12.157Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3456
- **ID:** TL-2026-3456
- **Severity:** CRITICAL (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-96951, CVE-2026-104935

## Description

CISA added two vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog on 2026-10-13, citing evidence of active exploitation. CISA notes these vulnerability types are a frequent attack vector for malicious cyber actors and directs Federal Civilian Executive Branch agencies to BOD 26-04, which requires rapid remediation of high-risk KEV vulnerabilities, particularly on publicly exposed assets. The CISA alert itself states no due date; the KEV catalog entry for CVE-2026-104935 lists a due date of 2026-10-16 with the required action to apply mitigations per vendor instructions in compliance with BOD 26-04 (evaluate internet exposure, follow patching timelines, or discontinue the product if fixes are unavailable) and notes forensic triage is required. Ransomware use is listed as Unknown for that entry.

CVE-2026-96951 (Microsoft Windows Shell command injection, CWE-77): per the NVD record, improper neutralization of special elements used in a command in Windows Shell allows an unauthorized attacker to bypass a security feature over a network. NVD scores it 8.8 HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning network-reachable, low complexity, no privileges, and user interaction required. Affected products listed: Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), Windows Server 2012 R2, 2016, 2019, 2022 and 2025, plus the Outlook.com service (builds before 20260925.100). The Microsoft MSRC guide is the vendor reference; its page could not be rendered during research, so KB numbers and fixed build numbers are not recorded here.

CVE-2026-104935 (Ivanti Connect Secure authentication bypass by spoofing, CWE-290): per the NVD record, authentication bypass by spoofing in Ivanti Connect Secure (ICS) before 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. NVD scores it 8.6 HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L: network, low complexity, no privileges, no user interaction). Affected: ICS 25.1.0.0 through 25.1.1.1, 25.1.2.x and 22.8R2 through 22.8R2.4; fixed in 25.1.3.0 and 22.8R2.5 and later; 22.7R2.14 and earlier is stated as not affected. The Ivanti advisory page could not be rendered during research, so Ivanti-published mitigations and indicators of compromise were not retrieved.

No threat actor, campaign, malware, C2 infrastructure, file hashes or network indicators are stated in the CISA alert, KEV entries or NVD records, so none are recorded; attribution is Unknown. Web searches found no public reporting specific to either CVE beyond these records. Because no network IOCs exist, no BeaconBeagle correlation was possible. The IOC list is therefore limited to affected-product and version identifiers useful for asset exposure matching. Defenders should treat internet-facing Ivanti Connect Secure appliances as the highest-priority exposure, apply vendor patches or mitigations, and follow Ivanti's integrity-check and forensic guidance since exploitation is confirmed.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1203 Exploitation for Client Execution
- T1204 User Execution
- T1553 Subvert Trust Controls
- T1566 Phishing
- T1566.001 Phishing
- T1566.002 Phishing
- T1204.002 User Execution
- T1204.001 User Execution
- T1553.005 Subvert Trust Controls
- T1211 Exploitation for Defense Evasion
- T1189 Drive-by Compromise
- T1566.003 Phishing

## Sources

- [CISA Alert: CISA Adds Two Known Exploited Vulnerabilities to Catalog](https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-adds-two-known-exploited-vulnerabilities-catalog)
- [CISA KEV Catalog Entry: CVE-2026-96951 (Microsoft Windows Command Injection)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96951)
- [CISA KEV Catalog Entry: CVE-2026-104935 (Ivanti Connect Secure Authentication Bypass by Spoofing)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104935)
- [CISA BOD 26-04 Implementation Guidance: Prioritizing Security Updates Based on Risk](https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk)
- [Microsoft MSRC Update Guide: CVE-2026-96951](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951)
- [Ivanti Security Advisory: Ivanti Connect Secure CVE-2026-104935](https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935)
- [NVD: CVE-2026-96951](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-96951)
- [NVD: CVE-2026-104935](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-104935)
- [CVE Record CVE-2026-96951](https://www.cve.org/CVERecord?id=CVE-2026-96951)
- [CVE Record CVE-2026-104935](https://www.cve.org/CVERecord?id=CVE-2026-104935)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3456