GUARDED

The threat level is CRITICAL because newly reported active exploitation affects both Microsoft Windows and Ivanti Connect Secure, creating immediate exposure-review and remediation priorities for organizations using affected products. CVE-2026-96951 is reported as exploited in the wild and affects Windows Shell; CVE-2026-104935 is a pre-disclosure Ivanti Connect Secure authentication-bypass flaw that permits remote unauthenticated command execution and is reported to have affected a limited number of customers. The previous concerns for affected reachable AhsayCBS and N-central deployments remain material unless their exposure and remediation status have changed. Public exploitation signals remain distributed beyond a few CVEs: the leading five account for 0.252 of 115 30-day signal chains. Tool availability is broad—651 PoC/template observations and two functional-exploit observations in seven days—but no weaponization observations were recorded; mixed legacy measures cannot establish weaponization growth. First-party releases show six possible-CVE vulnerability-exploit findings, including payload activity, but no likely exploit attempts or successful exploitation. These findings are useful leads, not compromise confirmation. Organizations should urgently identify and remediate affected Windows and Ivanti assets, then investigate relevant indicators where exposure or suspicious activity exists.