Microsoft shipped its largest Patch Tuesday release to date, addressing 1,413 vulnerabilities across its product line. Among them is CVE-2026-96951, a Windows vulnerability confirmed to be exploited in the wild.

The two sources describe the flaw somewhat differently: SecurityWeek characterizes CVE-2026-96951 as a security feature bypass, while CISA’s Known Exploited Vulnerabilities (KEV) catalog entry lists it as a Windows command injection vulnerability. Regardless of the exact technical classification, both confirm the flaw is being actively exploited and warrants immediate attention.

CISA KEV Catalog Update

On October 13, 2026, CISA added two vulnerabilities to its KEV catalog based on evidence of active exploitation:

  • CVE-2026-96951, the Microsoft Windows vulnerability patched in this month’s update
  • CVE-2026-104935, an Ivanti Connect Secure authentication bypass by spoofing vulnerability

CISA notes that these vulnerability types are frequent attack vectors for malicious actors and pose significant risk to federal networks.

BOD 26-04 Requirements

The additions fall under Binding Operational Directive (BOD) 26-04, which establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. The directive requires agencies to prioritize rapid remediation of high-risk vulnerabilities on publicly exposed assets, particularly those that grant attackers full control of a system post-exploitation, while deferring lower-risk issues. BOD 26-04 also sets baseline expectations for agencies to check whether systems were compromised before a patch was applied.

While BOD 26-04 applies only to FCEB agencies, CISA is urging all organizations to adopt a risk-based approach to vulnerability management and prioritize KEV catalog entries.

What Security Teams Should Do

Given the scale of this month’s Microsoft update and the confirmed exploitation of CVE-2026-96951 alongside the Ivanti Connect Secure flaw, organizations running affected Windows systems or Ivanti Connect Secure appliances should prioritize patching immediately and review systems for signs of prior compromise.