CISA has added CVE-2026-96951 to its Known Exploited Vulnerabilities catalog. It is a command injection flaw in Microsoft Windows Shell that lets an unauthorized attacker bypass a security feature over a network.
What Is It
CVE-2026-96951 is an improper neutralization of special elements used in a command (CWE-77, command injection) in Windows Shell. Microsoft and NVD say an unauthorized attacker can use it to bypass a security feature over a network. NVD published the record on 2026-10-13, and its status is still "Undergoing Analysis."
Microsoft scores it CVSS 3.1 8.8 (HIGH) with the vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. That means:
- it can be exploited over the network
- the attack is low complexity
- no privileges are needed
- the user has to take some action
- the impact on confidentiality, integrity and availability is high
Why It Matters
CISA's KEV catalog confirms this flaw is being actively exploited. CISA added it on 2026-10-13 and set a remediation due date of 2026-10-16, three days later. CISA has also flagged the entry for forensic triage ("Forensics Triage Requirements: Yes"). That suggests organizations should check for signs of compromise as well as patch. Whether it has been used in ransomware campaigns is listed as "Unknown."
What's Vulnerable
NVD lists these Microsoft products as affected below the fixed builds shown:
- Windows 10 1607 (< 10.0.14393.9612), 1809 (< 10.0.17763.9376), 21H2 (< 10.0.19044.7807)
- Windows 10 22H2: the affected range in NVD starts at build 10.0.19045.0, but its listed upper bound (10.0.19044.7807) is the 21H2 build, which is lower than that starting point. This looks like a data-entry error in the record. Check the correct 22H2 fixed build in the MSRC Security Update Guide before you treat any 22H2 system as patched.
- Windows 11 23H2 (< 10.0.22631.7652), 24H2 (< 10.0.26100.9711), 25H2 (< 10.0.26200.9711), 26H1 (< 10.0.28000.3231), 26H2 (< 10.0.26300.9711)
- Windows Server 2012 R2, including Server Core (< 6.3.9600.23470)
- Windows Server 2016, including Server Core (< 10.0.14393.9612)
- Windows Server 2019, including Server Core (< 10.0.17763.9376)
- Windows Server 2022 (< 10.0.20348.5761)
- Windows Server 2025, including Server Core: NVD lists the fixed build as 10.0.26100.33650. Windows Server 2025 shares the 26100 base build with Windows 11 24H2, and NVD lists 24H2 as fixed at 10.0.26100.9711. Two very different revision numbers on the same base build suggest one of the two entries is wrong. Check the correct Windows Server 2025 fixed build in the MSRC Security Update Guide before you treat any Server 2025 system as patched or unpatched.
- Outlook.com (< 20260925.100)
Patch Status
Microsoft has published guidance for this CVE in the MSRC Security Update Guide. CISA's required action is to apply mitigations according to the vendor's instructions, following BOD 26-04 ("Prioritizing Security Updates Based on Risk") and CISA's Forensics Triage Requirements. Cloud services should follow the applicable BOD 26-04 guidance. If no mitigations are available, stop using the product. Stakeholders must assess each asset's internet exposure and follow the BOD 26-04 patching guidelines. Federal agencies must act by 2026-10-16.