---
title: Tip: federal KEV clocks — MotW/Ivanti due Oct 16; Cisco SEG, PAN-OS, Ahsay due Oct 17 (BOD 26-04 triage) | ctxsec
url: https://ctxsec.com/items/tip-kev-deadlines-oct-16-17
description: ""
status: "how-to"
published: 2026-10-16
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-kev-deadlines-oct-16-17.md)

how-to

2026-10-16

### Tip: federal KEV clocks — MotW/Ivanti due Oct 16; Cisco SEG, PAN-OS, Ahsay due Oct 17 (BOD 26-04 triage)

Today (Oct 16) is the CISA KEV due date for CVE-2026-96951 (Windows Shell MotW bypass) and CVE-2026-104935 (Ivanti Connect Secure). Tomorrow (Oct 17) covers CVE-2026-76519 (Cisco Secure Email Gateway), CVE-2026-0322 (PAN-OS), and CVE-2026-105133/105134 (AhsayCBS). For FCEB (and anyone mirroring BOD 26-04): confirm internet exposure, apply vendor fixes, and complete forensic triage where KEV notes require it (Ahsay command-injection and Atlassian CVE-2026-21589 already flagged). Practical checklist: inventory edge appliances, pull version/build strings (Ahsay must be ≥10.3.4.45 / ≥9.15.2.70—not the incomplete earlier builds), rotate credentials on any pre-patch appliance, and keep management interfaces off the public internet.

Sources: [CISA KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) · [CISA Oct 14 KEV alert (4 adds)](https://www.cisa.gov/news-events/alerts/2026/10/14/cisa-adds-four-known-exploited-vulnerabilities-catalog)