CISA KEV Adds Exploited Windows MOTW Bypass and Ivanti Connect Secure Flaw

The two entries are:

• CVE-2026-96951: listed by CISA as a Microsoft Windows command injection vulnerability.
• CVE-2026-104935: listed by CISA as an Ivanti Connect Secure authentication bypass by spoofing vulnerability.

CISA's alert says these kinds of flaws are a frequent attack vector and pose significant risk to the federal enterprise. In practice, if you run Windows endpoints or an Ivanti VPN appliance, you have work to do this week.

CVE-2026-96951: The Windows Shell flaw behind October's only zero-day​

The Windows bug's CVE record describes it as improper neutralization of special elements used in a command in Windows Shell. That flaw lets an unauthorized attacker bypass a security feature over a network. Microsoft fixed it in the October 2026 Patch Tuesday release. The SANS Internet Storm Center called it "an already exploited Windows Shell Security Feature Bypass Vulnerability."

The security feature in question is Mark of the Web (MOTW). This is the tag Windows puts on files that come from the internet, and it triggers SmartScreen prompts and Protected View warnings. According to SANS, the flaw allows bypassing the "Mark of the Web" making it easier to execute code by sending a malicious message to a user via e-mail or instant messaging. The victim will still have to open the file.

Patch management vendor Action1 explains the attack the same way. Attackers can bypass these protections using specially crafted files delivered through phishing emails, instant messages, or malicious websites, and although successful exploitation requires user interaction, attackers do not need existing privileges on the targeted system. In Action1's sysadmin brief, the problem is that attackers still need users to interact with malicious content, but the expected security warnings may not appear.

Precision matters here. This is a security feature bypass, not remote code execution that works with no user action. Simply receiving an email does not compromise a PC. The flaw strips away one of the warnings that might make a user stop before double-clicking. If your phishing defences assume people will see a "this file came from the internet" prompt, this bug removes that prompt.

The score is high for a bypass. Action1 lists it at CVSS Score: 8.8, Severity: Important, and the CVE record mirrored by the Vulners database also shows CVSS 3.1 8.8 under CWE-77 (command injection).

Affected Windows branches​

According to the Microsoft CVE data mirrored by Vulners, the flaw affects a very wide range of Windows versions. The listed product branches are:

Server Core installations are listed alongside the full installations. Windows 10 22H2 also appears, but its entry pairs a 10.0.19045 starting build with a 10.0.19044.7807 fix threshold, which looks like a data-entry inconsistency. The mirrored record also lists Outlook.com as an affected product, with versions below 20260925.100 marked affected. Because Outlook.com is a Microsoft-run service, that entry suggests Microsoft fixed its part on the server side, but the record doesn't say so outright. Treat this table as a guide, not gospel. Check fixed builds in Microsoft's Security Update Guide before you sign off on compliance.

The Vulners record also links the CVE to the October 13 Monthly Rollup KB5126836, which applies to older servicing branches.

A record-size Patch Tuesday​

The exploited bug arrived in an unusually large release, and the totals vary by who is counting. SANS reported that Microsoft today released patches for 1,417 vulnerabilities. CyberInsider put the number at 1,413 vulnerabilities, and NTCompatible called it Microsoft's largest release ever, packing roughly 1,413 CVEs across 176 updates. Whatever the exact count, the advice is the same everywhere: patch CVE-2026-96951 first. Action1 also points out that a workstation used for email, downloads, and external file sharing may face greater exposure than an isolated system with the same vulnerability.

Section summary: CVE-2026-96951 lets malicious files skip MOTW warnings. A user still has to open the file. It is being exploited now, and the October cumulative updates fix it on every supported Windows branch.

CVE-2026-104935: Ivanti Connect Secure, again​

The second KEV entry continues a pattern many network administrators already know. BleepingComputer reports that Ivanti told customers on October 13 to patch an actively exploited zero-day in Connect Secure (ICS) immediately. ICS is the SSL VPN product formerly sold as Pulse Connect Secure.

Key facts from BleepingComputer's reporting:

• Affected versions: ICS 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier.
• Impact: remote attackers with no privileges can run arbitrary commands on the appliance. The attack is low-complexity and needs no user interaction.
• Ivanti's statement: Ivanti said it knew of "limited exploitation in the wild" and told customers to upgrade to the fixed version and run its Integrity Checker Tool (ICT) regularly.
• Exposure: Shadowserver tracks more than 5,500 internet-exposed ICS instances. It is not known how many are honeypots or are already patched.

NHS England Digital's advisory rates the flaw at CVSS 3.0 8.6. It says successful exploitation could let a remote unauthenticated attacker run arbitrary commands, and its national security operations centre judges further exploitation "highly likely." The NHS lists affected versions as "all prior to" those same three version numbers, which conflicts with the "and earlier" wording elsewhere. That conflict is one more reason to confirm your exact branch and fixed build against Ivanti's own advisory before you upgrade.

The part that should worry defenders​

Volexity found and reported the flaw. According to BleepingComputer, Volexity says a previously unknown actor it tracks as UTA0576 has chained CVE-2026-104935 with two other flaws since at least October 3 to get unauthenticated root-level code execution on fully patched devices. Threat intelligence firm Defused separately reported exploitation attempts starting October 1.

Two details stand out:

1. No malware was left behind. Volexity says the actor installed no web shell, re-exploited the device for every command it ran, and tampered with logs. That let it evade Ivanti's Integrity Checker Tool.
2. Part of the chain is still unpatched. Ivanti has fixed two of the flaws but is still working on a privilege escalation bug used in the same chain.

Put those together, and a clean ICT scan does not prove an appliance was never compromised, and upgrading closes only part of the attack path. Teams running ICS should check device telemetry and upstream network logs from late September onward. Don't rely on logs stored on the device itself.

The history isn't encouraging. BleepingComputer lists earlier exploited ICS zero-days:

• CVE-2023-46805 and CVE-2024-21887, patched in January 2024
• CVE-2024-21893, patched two weeks later
• CVE-2025-0282, patched in January 2025
• CVE-2025-22457, exploited by China-linked spies from mid-March 2025

It also counts 36 Ivanti vulnerabilities CISA has flagged as exploited since November 2021, 12 of them used by ransomware gangs.

Section summary: CVE-2026-104935 is an exploited, unauthenticated flaw at the edge of the network. It sits in an attack chain that is only partly patched, and the attacker has shown it can avoid Ivanti's own integrity checks. Patch it, then go looking for signs of compromise.

What BOD 26-04 means here​

CISA's alert frames the additions around Binding Operational Directive 26-04, "Prioritizing Security Updates Based on Risk," issued June 10, 2026. It replaces BOD 22-01, which created the KEV Catalog, and BOD 19-02. Instead of one fixed deadline for every KEV, it sets remediation timelines for Federal Civilian Executive Branch (FCEB) agencies using four factors:

• KEV status: is the CVE in the catalog?
• Asset exposure: is the asset publicly exposed?
• Exploit automation: can attackers automate exploitation?
• Technical impact: does exploitation give partial or total control?

CISA's alert stresses fast remediation for KEV-listed flaws on publicly exposed assets where exploitation gives total control, and lets agencies defer lower-risk items. In the highest-risk cases, the directive pairs a three-day remediation window with a mandatory "forensic triage" to check whether the system was compromised before the patch. Timelines are also dynamic. Taking a system off the internet lengthens its window, and a new KEV listing shortens it.

The directive's broad logic suggests how the two CVEs might be treated, though CISA's per-CVE ratings were not available for review. An internet-facing Ivanti gateway hit by unauthenticated command execution fits the description of a total-control flaw on a publicly exposed asset. A Windows Shell bypass that needs a user to open a file is a different kind of risk. Agencies should use CISA's published Vulnrichment data and KEV entry notes rather than guessing.

BOD 26-04 only binds FCEB agencies. CISA still encourages every organization to adopt risk-based vulnerability management and to prioritize KEV-listed flaws.

Your to-do list​

For Windows admins:

1. Deploy the October 2026 cumulative updates (or the Monthly Rollup on older branches), starting with machines used for email and web browsing.
2. Check installed builds against Microsoft's Security Update Guide entry for CVE-2026-96951, not just against "update installed" status in your console.
3. Remind users about unexpected attachments and links in chat messages. That reminder helps, but it does not replace the patch.

For Ivanti Connect Secure operators:

1. Inventory every ICS appliance and confirm its exact software branch.
2. Upgrade to the fixed release named in Ivanti's advisory as soon as possible.
3. Run the Integrity Checker Tool, but don't treat a clean result as an all-clear given Volexity's findings.
4. Review off-device logs and network telemetry from at least late September onward, and follow your incident response process if anything looks wrong.
5. Watch for Ivanti's fix for the remaining privilege escalation flaw.

Do you know of an exploited vulnerability that isn't in the catalog? CISA accepts nominations through its KEV Nomination Form. A candidate needs a CVE ID, evidence of exploitation, and clear mitigation guidance.

Bottom line: one entry removes a safety warning on Windows PCs, and the other gives attackers a way into the network through the VPN. Both are being exploited. Patch the Windows bug quickly, and treat the Ivanti bug as a possible breach as well as a patching job.