CISA has added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog. The most identity-relevant is CVE-2026-104935, an authentication bypass by spoofing in Ivanti Connect Secure, which could let attackers evade authentication controls on a widely deployed VPN/remote-access gateway. The second, CVE-2026-96951, is a Microsoft Windows command injection vulnerability.
Authentication bypass flaws in edge access products like Ivante Connect Secure are especially dangerous because they sit at the perimeter and often serve as the entry point into internal networks and directory services. Once past authentication, attackers can pivot toward credential theft, lateral movement, and Active Directory compromise. The Windows command injection issue similarly can aid privilege escalation and code execution on domain-joined assets.
What to take away: Both CVEs are confirmed under active exploitation and fall under BOD 26-04 remediation timelines for federal agencies. Organizations should prioritize patching exposed Ivanti appliances, review authentication and VPN logs for signs of bypass, and assume compromise checks are warranted on internet-facing systems.