CISA Adds Two Known Exploited Vulnerabilities to Catalog
Summary
CISA has added two new vulnerabilities, CVE-2026-96951 and CVE-2026-104935, to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. These additions are part of CISA's Binding Operational Directive (BOD) 26-04, which requires federal agencies to prioritize the remediation of high-risk, exploited vulnerabilities on publicly exposed assets.
IFF Assessment
The article highlights newly cataloged exploited vulnerabilities, indicating increased risk and a greater need for immediate patching by defenders.
Severity
CISA KEV: Listed as actively exploited. Federal patch due: October 16, 2026. Known ransomware use: Unknown.
Defender Context
Defenders should prioritize patching the newly added CVEs, CVE-2026-96951 and CVE-2026-104935, as they are known to be actively exploited. Organizations, especially federal agencies, must adhere to CISA's BOD 26-04 for risk-based vulnerability management, focusing on KEV cataloged vulnerabilities on critical assets to mitigate immediate threats.