CVE-2026-96951 Exploited in the wild
Microsoft Windows Command Injection Vulnerability
- Risk score
- 100/100
- CVSS
- 8.8 v3.1
- Exploit chance (30 days)
- 1.5%
- Published
- 13 Oct 2026
- Added to CISA's exploited list
- 13 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A vulnerability in Windows Shell allows an attacker to bypass a security feature over a network through command injection. An attacker could exploit this to gain high-level privileges, access, and impact.
- Affected
- {'product': 'Microsoft Windows', 'package': 'Windows Shell', 'version': 'Unknown'}
- Fix
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance
- Exploitation
- Exploited in the wild
In the news
TL;DR
Microsoft patches 1400+ CVEs, including CVE-2026-96951, a Windows Shell security feature bypass vulnerability with CVSS 8.8, exploited in the wild.
- CVE-2026-96951 is a security feature bypass in Windows Shell, affecting Windows 10, 11, and some Server versions.
- 78 of the patched flaws are rated critical, allowing attackers to execute code.
- Microsoft uses AI to find and fix vulnerabilities, leading to a surge in patch volume.
- Security teams are struggling to keep up with the increased workload, with some CISOs calling in sick or booking holiday time.
AI summary of 2 articles.
Why it is Red
- CVSS 8.8 high
- Exploited in the wild (CISA KEV)
- Remotely exploitable without logging in
- On your watchlist: windows server
CISA required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
References
Original description
Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
Last activity 13 Oct 2026. Patch Forecast updates every hour.