CISA Issues KEV Alert for Microsoft Windows and Ivanti Vulnerabilities Under Active Attack
Executive Summary
CISA added two critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation in the wild. CVE-2026-96951 affects Microsoft Windows systems through command injection flaws, while CVE-2026-104935 targets Ivanti Connect Secure appliances via authentication bypass through spoofing mechanisms. These vulnerabilities are being actively exploited by threat actors to gain initial access and establish persistence in enterprise environments, posing significant risks to federal and private sector organizations.
This incident highlights the ongoing trend of attackers targeting network infrastructure and authentication systems to bypass perimeter defenses. With the rise of sophisticated threat actors exploiting zero-day and recently disclosed vulnerabilities at an accelerated pace, organizations face increasing pressure to implement rapid patch management and zero-trust security models.
Why This Matters Now
Federal agencies must remediate these KEV-listed vulnerabilities under BOD 26-04 requirements, while private organizations face similar risks from active exploitation campaigns targeting authentication bypass and command injection vectors in critical infrastructure components.
Attack Path Analysis
Attackers exploited CVE-2026-96951 (Windows Command Injection) and CVE-2026-104935 (Ivanti Connect Secure Authentication Bypass) to gain initial access to enterprise environments. Following successful exploitation, attackers escalated privileges through credential harvesting, moved laterally across network segments, established persistent command and control channels, exfiltrated sensitive data, and potentially deployed ransomware or destructive payloads to maximize business impact.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Attackers exploited CVE-2026-96951 Windows Command Injection vulnerability and CVE-2026-104935 Ivanti Connect Secure Authentication Bypass to gain unauthorized access to target systems
Related CVEs
CVE-2026-96951
CVSS 8.8A command injection vulnerability in Microsoft Windows allows authenticated attackers to execute arbitrary commands with elevated privileges.
Affected Products:
Microsoft Windows – Multiple versions affected
Exploit Status:
exploited in the wildCVE-2026-104935
CVSS 8.6An authentication bypass vulnerability in Ivanti Connect Secure allows attackers to spoof authentication and gain unauthorized access to corporate networks.
Affected Products:
Ivanti Connect Secure – Multiple versions affected
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Valid Accounts
Command and Scripting Interpreter
Abuse Elevation Control Mechanism
Process Injection
Indicator Removal
External Remote Services
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
CISA Zero Trust Maturity Model 2.0 – Asset Management and Inventory
Control ID: ID.AM-2
NYDFS 23 NYCRR 500 – Risk Assessment
Control ID: 500.09
PCI DSS 4.0 – Security Vulnerabilities
Control ID: 6.3.1
DORA – Identification
Control ID: Article 8
NIS2 Directive – Cybersecurity Risk Management
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Government Administration
Federal agencies face mandatory remediation under BOD 26-04 for Microsoft Windows and Ivanti vulnerabilities enabling command injection and authentication bypass exploitation.
Information Technology/IT
IT infrastructure providers managing Microsoft Windows and Ivanti Connect Secure systems require immediate patching to prevent command injection and authentication spoofing attacks.
Financial Services
Banking systems using affected Microsoft and Ivanti technologies face regulatory compliance risks and potential unauthorized access through authentication bypass vulnerabilities.
Health Care / Life Sciences
Healthcare organizations must prioritize patching Microsoft Windows and Ivanti systems to maintain HIPAA compliance and prevent unauthorized access to sensitive patient data.
Sources
- CISA Adds Two Known Exploited Vulnerabilities to Cataloghttps://www.cisa.gov/news-events/alerts/2026/10/13/cisa-adds-two-known-exploited-vulnerabilities-catalogVerified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- Binding Operational Directive 26-04: Prioritizing Security Updates Based on Riskhttps://www.cisa.gov/binding-operational-directive-26-04Verified
- Microsoft Security Response Centerhttps://msrc.microsoft.com/security-guidanceVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF would likely constrain this multi-stage attack by limiting lateral movement paths and reducing attacker blast radius across network segments. The fabric's segmentation controls could reduce the scope of privilege escalation and data exfiltration capabilities.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Initial system compromise may still occur, but the fabric would likely limit the attacker's ability to discover and reach additional network resources beyond the initially compromised endpoint
Control: Zero Trust Segmentation
Mitigation: Privilege escalation attempts would likely be constrained to the specific network segment where the compromise occurred, reducing the scope of administrative access across the broader environment
Control: East-West Traffic Security
Mitigation: Lateral movement capabilities would likely be significantly constrained by traffic inspection and policy enforcement that blocks unauthorized inter-segment communications and workload-to-workload access paths
Control: Multicloud Visibility & Control
Mitigation: Command and control establishment would likely be constrained by visibility controls that monitor and potentially block unauthorized communication patterns across multicloud environments and hybrid infrastructures
Control: Egress Security & Policy Enforcement
Mitigation: Data exfiltration would likely be constrained by egress controls that monitor and restrict outbound data flows, potentially blocking or limiting the volume of sensitive information transferred to external destinations
While some systems may remain at risk, the overall business impact would likely be reduced due to constrained attacker reach and limited access to critical assets across segmented network boundaries
Impact at a Glance
Affected Business Functions
- Federal Agency Operations
- Network Security Infrastructure
- Authentication Systems
- Command and Control Systems
Estimated downtime: N/A
Estimated loss: N/A
Potential exposure of federal enterprise systems, authentication credentials, and administrative access to Windows and VPN infrastructure affecting multiple government agencies
Recommended Actions
Key Takeaways & Next Steps
- • Implement Inline IPS (Suricata) with updated signatures to detect and block exploitation attempts targeting CVE-2026-96951 and CVE-2026-104935 before they reach vulnerable systems
- • Deploy Zero Trust Segmentation with least privilege policies to prevent lateral movement between network segments and limit the blast radius of successful compromises
- • Enable Egress Security & Policy Enforcement to detect and block unauthorized data exfiltration attempts and command and control communications
- • Implement Multicloud Visibility & Control to detect anomalous interactions and suspicious automation patterns that may indicate ongoing attacks
- • Establish Threat Detection & Anomaly Response capabilities with baseline monitoring to identify deviations from normal behavior patterns and enable rapid incident response
