CISA KEV Alert: CVE-2026-96951 (Windows Command Injection) and CVE-2026-104935 (Ivanti Connect Secure Auth Bypass) — Detection and Remediation Guide

On October 13, 2026, CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on confirmed evidence of active in-the-wild exploitation: CVE-2026-96951, a command injection vulnerability in Microsoft Windows, and CVE-2026-104935, an authentication bypass via spoofing vulnerability in Ivanti Connect Secure. Both are now mandated remediation items under Binding Operational Directive (BOD) 26-04, which requires Federal Civilian Executive Branch (FCEB) agencies to prioritize rapid patching of KEV-listed vulnerabilities.

For those of us who have worked IR engagements involving edge device compromise, this pairing should set off alarms. Ivanti Connect Secure has been a recurring initial-access vector in campaigns over the last several years — authentication bypasses on internet-facing VPN gateways are consistently among the first targets of both nation-state operators and ransomware affiliates. Pair that with a command injection primitive in Windows, and you have a classic chain: bypass the gateway, gain an authenticated foothold, then pivot to internal Windows hosts for code execution and lateral movement.

If you run Ivanti Connect Secure anywhere on your perimeter, treat this as a drop-everything event. If you don't, the Windows command injection still demands attention — KEV listing means exploitation is confirmed, not theoretical.

Technical Analysis

CVE-2026-96951 — Microsoft Windows Command Injection Vulnerability

Vulnerability class: Command Injection (CWE-77/CWE-78). The flaw allows an attacker to inject operating system commands through a component that improperly neutralizes special elements in input passed to a command interpreter. In practical terms, exploitation typically manifests as a legitimate Windows process or service spawning cmd.exe, powershell.exe, or wscript.exe with attacker-controlled arguments — often with elevated integrity if the vulnerable component runs under SYSTEM or a service account.

Defender's perspective on the attack chain: Command injection bugs are prized because they convert a remote input handling flaw directly into arbitrary code execution, usually without requiring authentication to the target process itself. Post-exploitation, we consistently see these primitives used to stage downloaders (curl.exe, certutil.exe, bitsadmin), disable telemetry, or establish reverse shells. The critical detection signal is unexpected parent-child process relationships: a Windows service or system process that should never launch a command interpreter suddenly doing so.

CVE-2026-104935 — Ivanti Connect Secure Authentication Bypass by Spoofing

Vulnerability class: Authentication Bypass by Spoofing (CWE-290). The vulnerability allows an unauthenticated remote attacker to bypass the authentication mechanism of the Ivanti Connect Secure gateway by spoofing identity assertions — meaning the appliance accepts attacker-crafted input as proof of an authenticated session that never legitimately occurred.

Defender's perspective on the attack chain: This is the high-severity edge of this alert. Connect Secure appliances sit directly on the internet, and an auth bypass here hands an attacker an authenticated VPN session, admin interface access, or both — without credentials, phishing, or any prior foothold. In every prior Ivanti edge-device incident we have responded to or tracked, exploitation was followed within hours by: (1) deployment of web shells or implants onto the appliance itself, (2) harvesting of cached credentials and session tokens, and (3) lateral movement into the internal network using the VPN's trusted position. Assume that any unpatched, internet-reachable Connect Secure gateway exposed to exploitation is compromised until forensic review proves otherwise.

Exploitation Status

Both CVEs are listed in the CISA KEV Catalog, which by definition means confirmed active exploitation. This is not a proof-of-concept or theoretical scenario — adversaries are using these primitives in live operations today. Under BOD 26-04, FCEB agencies are required to remediate KEV entries within the mandated window; private-sector organizations should treat the same timeline as their de facto SLA. Ivanti Connect Secure and Windows environments of all sizes are in scope.

Note: CISA's alert did not publish CVSS scores at the time of this writing. Consult the Microsoft Security Update Guide and the Ivanti Security Advisory for severity scoring, affected version ranges, and fixed builds as they are published.

Detection & Response

Sigma Rules

The following rules target the observable behaviors of both exploitation chains: command-interpreter spawning characteristic of CVE-2026-96951 exploitation, and anomalous authenticated access patterns on Ivanti Connect Secure gateways characteristic of CVE-2026-104935. Tune thresholds against your baseline — these are hunting rules, not install-and-forget detections.

---
title: Suspicious Command Interpreter Spawned by Windows Service Process
description: Detects cmd.exe, powershell.exe, or script hosts spawned by Windows service/system processes, consistent with post-exploitation behavior of command injection vulnerabilities such as CVE-2026-96951.
references:
  - https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-adds-two-known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/10/13
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\svchost.exe'
      - '\spoolsv.exe'
      - '\lsass.exe'
      - '\services.exe'
      - '\wmiprvse.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
  filter_known_spoolsv:
    ParentImage|endswith: '\spoolsv.exe'
    Image|endswith:
      - '\splwow64.exe'
  condition: (selection_parent and selection_child) and not filter_known_spoolsv
falsepositives:
  - Legitimate print driver or WMI administrative activity; baseline service-spawned script hosts in management tooling
level: high
---
title: Command Injection Staging via Built-In Windows Downloaders
description: Detects execution of certutil, curl, or bitsadmin with network-fetch arguments from an unexpected parent, a common post-exploitation staging step following command injection such as CVE-2026-96951.
references:
  - https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-adds-two-known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/10/13
tags:
  - attack.command_and_control
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\certutil.exe'
      - '\curl.exe'
      - '\bitsadmin.exe'
  selection_args:
    CommandLine|contains:
      - 'http://'
      - 'https://'
      - '-urlcache'
      - '/transfer'
      - ' -O '
      - ' -o '
  condition: selection_image and selection_args
falsepositives:
  - Software deployment tools and IT automation scripts performing legitimate downloads; allowlist known deployment parent processes
level: medium
---
title: Anomalous Ivanti Connect Secure Administrative or VPN Session Source
description: Detects successful authentication events on Ivanti Connect Secure from unusual source addresses or at unusual volume, consistent with authentication bypass exploitation such as CVE-2026-104935. Ingest ICS syslog/CEF via forwarder.
references:
  - https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-adds-two-known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/10/13
tags:
  - attack.initial_access
  - attack.persistence
  - attack.t1078
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    DestinationPort:
      - 443
      - 4443
    ProcessName|contains:
      - 'web'
      - 'dslogd'
  keywords:
    - 'Primary authentication successful'
    - 'Admin login succeeded'
    - 'session started'
  condition: selection and keywords
falsepositives:
  - Legitimate VPN user logins; correlate against known user subnets, VPN egress ranges, and admin workstation IPs before escalating
level: high

KQL — Microsoft Sentinel / Defender

The first query hunts for the command injection post-exploitation pattern on Windows endpoints via Defender for Endpoint. The second hunts Ivanti Connect Secure authentication anomalies using ingested syslog/CEF data, flagging admin logins or successful authentications from sources outside your known VPN user and administration ranges.

// Hunt 1: Suspicious command interpreters spawned by Windows service processes (CVE-2026-96951 behavior)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("svchost.exe", "spoolsv.exe", "services.exe", "wmiprvse.exe", "lsass.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "certutil.exe", "curl.exe")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, ReportId
| order by TimeGenerated desc;

// Hunt 2: Ivanti Connect Secure successful admin/VPN authentications from unusual sources (CVE-2026-104935 behavior)
// Adjust KnownAdminSubnets and KnownVpnSubnets to your environment
let KnownAdminSubnets = dynamic(["10.10.5.0/24", "192.168.50.0/24"]);
let KnownVpnSubnets = dynamic(["100.64.0.0/10"]);
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DeviceVendor =~ "Ivanti" or DeviceProduct has_any ("Connect Secure", "Pulse Secure")
| where Message has_any ("Admin login succeeded", "Primary authentication successful", "session started")
| extend SrcIP = tostring(SourceIP)
| where not (ipv4_is_in_any_range(SrcIP, KnownAdminSubnets)) and not (ipv4_is_in_any_range(SrcIP, KnownVpnSubnets))
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), DistinctMessages = make_set(Message) by SrcIP, SourceUserName, DeviceName
| order by EventCount desc;

Velociraptor VQL

This artifact collects process execution telemetry from Windows endpoints to identify service-spawned command interpreters and staging tool execution consistent with post-exploitation of the command injection flaw. Run it as a hunt across your fleet during triage.

-- Hunt for command interpreters and staging tools spawned by Windows service processes
-- Targets post-exploitation behavior consistent with command injection (CVE-2026-96951)
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(cmd|powershell|pwsh|wscript|cscript|mshta|certutil|curl|bitsadmin)\.exe$'
  AND Ppid IN (
    SELECT Pid FROM pslist()
    WHERE Name =~ '(svchost|spoolsv|services|wmiprvse|lsass)\.exe$'
  )

Verification and Hardening Script

Use the following PowerShell to check Windows endpoint patch status against the October 2026 cumulative updates, enumerate recently created command-line audit entries for staging-tool execution, and confirm process creation auditing (Event ID 4688 with command line) is enabled — a prerequisite for the detections above.

# === CVE-2026-96951 / CVE-2026-104935 Verification & Hardening ===
# Run elevated on Windows endpoints. Review output before taking action.

# 1. List installed hotfixes from October 2026 onward — confirm the October 2026
#    cumulative update (which carries the CVE-2026-96951 fix) is present.
Get-HotFix | Where-Object { $_.InstalledOn -ge (Get-Date '2026-10-01') } |
  Sort-Object InstalledOn -Descending |
  Format-Table HotFixID, Description, InstalledOn -AutoSize

# 2. Check pending reboot status — an installed patch that is not rebooted is not effective
$pendingReboot = Test-Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired'
Write-Output "Pending reboot required: $pendingReboot"

# 3. Verify process creation auditing with command-line capture is enabled
$auditPol = auditpol /get /subcategory:"Process Creation"
Write-Output $auditPol
$cmdLineAudit = Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit' -Name 'ProcessCreationIncludeCmdLine_Enabled' -ErrorAction SilentlyContinue
if ($cmdLineAudit.ProcessCreationIncludeCmdLine_Enabled -ne 1) {
  Write-Output 'WARNING: Command-line auditing disabled. Enable via:'
  Write-Output 'Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit" -Name "ProcessCreationIncludeCmdLine_Enabled" -Value 1'
}

# 4. Sweep recent 4688 events for service-spawned staging tool execution (triage indicator)
Get-WinEvent -FilterHashtable @{ LogName = 'Security'; Id = 4688; StartTime = (Get-Date).AddDays(-7) } -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match '(certutil\.exe|curl\.exe|bitsadmin\.exe|mshta\.exe)' -and $_.Message -match 'http' } |
  Select-Object TimeCreated, @{N='CommandLine';E={ ($_.Message -split "`n") -match 'Process Command Line' }} |
  Format-List

For Ivanti Connect Secure appliances, use the following Bash checks on your management host or SIEM collector to verify gateway version and pull authentication logs for review. Do not run arbitrary scripts on the appliance itself; use Ivanti's published Integrity Checker Tool (ICT) for on-box compromise assessment.

# === Ivanti Connect Secure triage (CVE-2026-104935) ===
# 1. Confirm current gateway version against the Ivanti advisory's fixed build list
curl -sk https://<gateway-fqdn>/dana-na/auth/url_admin/welcome.cgi | head -20

# 2. Pull admin access logs for anomalous successful logins (adjust syslog target)
grep -E "Admin login succeeded|Primary authentication successful" /var/log/ivanti/admin_access.log \
  | awk '{print $NF}' | sort | uniq -c | sort -rn | head -30

# 3. Check for recently modified or anomalous files reported by Ivanti ICT output
#    (export ICT results from the appliance admin console and diff against baseline)
diff <(sort ict_baseline.txt) <(sort ict_current.txt)

# 4. Restrict admin interface exposure immediately — admin UI must never be internet-facing
#    Verify on your perimeter firewall that TCP 443 admin paths are blocked from untrusted sources

Remediation

1. Patch immediately, in priority order. The Ivanti Connect Secure gateway comes first — it is internet-facing and the auth bypass requires no prior access. Apply the fixed build published in the Ivanti Security Advisory for CVE-2026-104935 across all production, staging, and HA-paired appliances. Then deploy the Microsoft security update addressing CVE-2026-96951 fleet-wide via your normal update channel (WSUS, Intune, or Configuration Manager), and force reboots — an unrebooted endpoint remains exploitable.

2. Honor the BOD 26-04 deadline as your own SLA. FCEB agencies are legally bound to remediate within the window CISA specifies on the KEV entry. Private-sector organizations should adopt the same deadline; KEV-listed CVEs are actively exploited by definition, and edge-device CVEs historically see mass exploitation within days of disclosure.

3. Assume compromise on exposed Ivanti appliances. Patch alone does not evict an attacker who gained access before the fix. For every internet-reachable Connect Secure gateway that was unpatched during the exposure window: run Ivanti's Integrity Checker Tool, review admin and user authentication logs for anomalous source IPs and off-hours logins, rotate all credentials that traversed the appliance (including service accounts and any cached directory credentials), revoke active VPN sessions and reissue certificates, and check for unauthorized local accounts or configuration changes on the appliance itself. If the ICT flags integrity failures, factory-reset and rebuild from a known-good image rather than attempting in-place cleanup.

4. Harden the edge architecture. Restrict the Connect Secure admin interface to a dedicated management network reachable only from hardened admin workstations — the admin UI should never be internet-exposed. Enforce phishing-resistant MFA on all VPN and admin access, segment the VPN user pool so a compromised session cannot reach flat internal networks, and forward appliance logs (auth, admin, and system) to your SIEM in real time rather than relying on on-box logs an attacker can tamper with.

5. Validate Windows detection coverage. Confirm process creation auditing with command-line logging (Event ID 4688) is enabled fleet-wide and flowing to your SIEM; the Sigma and KQL detections above depend on it. Deploy the service-spawned interpreter rule in audit mode for 48 hours to baseline, then promote to alerting.

6. Track the advisories. Monitor the CISA KEV Catalog entry, the Microsoft Security Update Guide entry for CVE-2026-96951, and the Ivanti Security Advisory for CVE-2026-104935 for updated affected-version lists, additional indicators of compromise, and any escalation in exploitation reporting.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub