Two Actively Exploited Flaws Added to CISA's Watch List, Including a Windows Zero-Day
A security-feature bypass in Windows Shell and an Ivanti authentication bypass are both being used in real attacks, and US federal agencies have until 16 October 2026 to fix them.
Key points
- CVE-2026-96951, a security-feature bypass in Microsoft Windows Shell, was added to CISA's Known Exploited Vulnerabilities catalogue with confirmed active exploitation.
- A second flaw, CVE-2026-104935 in Ivanti Connect Secure, lets criminals impersonate a legitimate user and bypass login checks entirely.
- US federal civilian agencies must patch both vulnerabilities by 16 October 2026 under Binding Operational Directive 26-04, a compulsory government patching rule.
- Microsoft patched a record 1,413 vulnerabilities in this cycle, according to SecurityWeek, making prioritisation unusually difficult for IT teams.
Two security flaws are being used against real targets right now, and the US government's top cyber agency wants the holes sealed within days.
The Cybersecurity and Infrastructure Security Agency (CISA), the federal body responsible for protecting government computer networks, added both vulnerabilities to its Known Exploited Vulnerabilities catalogue. That catalogue is the government's running list of flaws criminals are already weaponising in the wild, not just flaws that look dangerous on paper.
What exactly are these two flaws?
CVE-2026-96951 is a security-feature bypass in Windows Shell, the part of Microsoft Windows that processes commands typed or sent to the operating system. It can be triggered remotely over a network, with no prior access required. Once in, an attacker bypasses protections the system was relying on.
Worth noting: we covered the Ivanti side of this pair separately. Our story on CVE-2026-104935 found that attackers can walk straight past the login screen and run commands on corporate network gateways. It's an authentication bypass by spoofing on Ivanti Connect Secure, a VPN product organisations use to let remote workers reach internal systems safely.
CISA's advisory notes that flaws like these are "a frequent attack vector" carrying "significant risks to the federal enterprise." That language is measured. The three-day patch deadline isn't.
Who has to act, and how fast?
Federal civilian agencies must patch by 16 October 2026. Under BOD 26-04, agencies must also check whether attackers got in before the patch was applied. That requirement signals CISA is treating these as genuine intrusion risks.
Private organisations aren't legally bound by that deadline, but the catalogue has always been a strong signal for everyone. Criminals using a flaw against federal networks are almost certainly using it elsewhere.
For home Windows users, automatic updates through Windows Update handle this. Confirming that auto-update is on is the only step most people need. Businesses running Ivanti Connect Secure should treat this as an emergency change, not a routine monthly update.
Should you worry about the wider patch volume?
Microsoft fixed a reported 1,413 vulnerabilities in this cycle, a record according to SecurityWeek. That volume makes it easy for a genuinely dangerous flaw to get buried. CVE-2026-96951 is the one that shouldn't be.
Federal agencies are also contending with a Palo Alto firewall flaw giving attackers root control, patched just days later with its own three-day government deadline. Patch fatigue at this pace is a real operational risk, and that's the thing to watch: not any single flaw, but whether teams can keep up with the cadence.
