Grade One Press

Technology reporting you can check

News · Security & privacy

CISA orders three-day remediation for actively exploited Windows and Ivanti flaws

The federal cyber agency added CVE-2026-96951 and CVE-2026-104935 to its catalog, invoking Binding Operational Directive 26-04 to mandate agency patching and forensic triage by 16 October.

Grade One Newsroom · 1 min read

Sources: 1 · top grade 1How evidence is graded

US agencies given three days to patch exploited Windows and Ivanti flaws

Grade 1 · Primary

Source: US Cybersecurity and Infrastructure Security Agency

What changed
CISA added two actively exploited flaws in Windows Shell and Ivanti Connect Secure to its catalog, mandating a three-day remediation deadline under BOD 26-04.
Who it affects
US Federal Civilian Executive Branch agencies operating Microsoft Windows or Ivanti appliances.
What it does not tell you
The notice does not disclose the specific threat actor groups, zero-day telemetry volume, or private-sector compromise counts.

The full story Check the source

The US Cybersecurity and Infrastructure Security Agency added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities Catalog on 13 October 2026 [1].

The entries cover a command injection vulnerability in Microsoft Windows Shell (CVE-2026-96951) and an authentication bypass vulnerability in Ivanti Connect Secure (CVE-2026-104935) [1].

Under Binding Operational Directive 26-04, federal civilian agencies must remediate both flaws within three days, setting a binding compliance deadline of 16 October 2026 [1].

The directive also requires agencies to perform forensic triage to confirm whether systems were compromised prior to applying vendor patches [1].

What it measures

Binding remediation duties for all US Federal Civilian Executive Branch agencies running vulnerable instances of Microsoft Windows or Ivanti Connect Secure network appliances [1].

What it does not tell you

The advisory lists ransomware campaign involvement as unknown and does not provide telemetry detailing the geographic distribution or number of non-governmental private-sector compromises [1].

Sources and their grades

  1. US Cybersecurity and Infrastructure Security Agency, CISA Adds Two Known Exploited Vulnerabilities to Catalog. Read 14 October 2026. Grade 1 · Primary Official federal directive under BOD 26-04. Entries for CVE-2026-96951 and CVE-2026-104935 with compliance due date 16 October 2026.

A grade says how much weight a source will take, from 1 (a body that can compel an answer and has nothing to sell) to 5 (somebody describing what they sell, or themselves). The standard sets out what each grade may be used for.

Filed under Government Regulation Security Vulnerabilities

Comments

Commenting needs an account, made with nothing but an email address. A first comment is read before it appears.

More news

See all