CVE-2026-96951

CVE Enrichment

CVSS: 8.8 HIGH
CISA KEV: YES — Known Exploited Vulnerability

Description

Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: secure@microsoft.com
Published: 14-Oct-2026 02:22
Last Modified: 14-Oct-2026 03:19
CWE: CWE-77

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:R /
                            S:U /
                            C:H /
                            I:H /
                            A:H

CISA KEV Details

Date Added: 2026-10-13
Remediation Due: 2026-10-16
Known Ransomware Campaign Use: Unknown
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-96951 ; BOD 26-04: BOD 26-04: Prioritizing Security Updates Based on Risk | CISA ; Forensics Triage Requirements: BOD 26-04: Implementation Guidance for Prioritizing Security Updates Based on Risk | CISA ; https://nvd.nist.gov/vuln/detail/CVE-2026-96951

References

Last enrichment sync: 14-Oct-2026 08:03
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (8)

The exploited zero-day is tracked as CVE-2026-96951 (CVSS score 8.8/10). Microsoft Fixes Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day
Microsoft, which credited Fujitsu's Riku Bamba and Yuya Chudo, as well as Anthropic's Benoit Sevens and a researcher named yhw for reporting CVE-2026-96951, said the vulnerability has been exploited in the wild. Microsoft Patches 1,413 Vulnerabilities, Including Actively Exploited Windows Shell Flaw
CVE-2026-96951 is a security feature bypass in the Windows Shell that affects Windows 10 and 11 systems, as well as some Server versions. Microsoft Patches More Than 1,400 Security Flaws, Including an Exploited Zero-Day
CVE-2026-96951 Windows Shell Security Feature Bypass Vulnerability Exploitation Detected No 8.8 Microsoft’s October 2026 Patch Tuesday Lists Hundreds of Vulnerabilities
CVE-2026-96951 Microsoft Windows Command Injection Vulnerability CISA Adds Two Actively Exploited Vulnerabilities to KEV Catalog

CVE (1238)

People (13)

MITRE ATT&CK (2)

Vendors (14)

Products (115)

Tools (1)

Industries (1)

Countries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.