CVE-2026-96951: Windows Shell Command Injection
Active exploitation confirmed in the wild. CISA added this to the KEV catalog on 2026-10-13. Federal agencies must patch by 2026-10-16.
TL;DR - CVE-2026-96951 is a high-severity Windows Shell command-injection vulnerability with an 8.8 CVSS score. - Affected Windows builds should be upgraded to Microsoft’s fixed builds immediately. - CISA confirms exploitation in the wild and lists a federal remediation deadline of October 16, 2026.
Are You Affected?
CVE-2026-96951 affects Microsoft Windows Shell and related Microsoft product and operating-system versions. The vulnerability allows an unauthorized attacker to bypass a security feature and execute injected command content after required user interaction. Available vulnerability records associate exploitation with specially crafted files, links, email messages, instant messages, or other attacker-delivered content.
Organizations responsible for Windows vulnerability patching should prioritize internet-exposed, high-value, and frequently targeted endpoints first.
| Field | Details |
|---|---|
| CVE ID | CVE-2026-96951 |
| CVSS | 8.8 High |
| CVSS vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| Attack vector | Network |
| Authentication or privileges required | None |
| User interaction | Required |
| Vulnerability type | Command injection, CWE-77 |
| Patch available | Yes |
| Exploitation status | Confirmed in the wild through CISA KEV inclusion |
| Ransomware use | Unknown |
The retrieved affected-version data identifies the following ranges:
| Product or release | Affected versions |
|---|---|
| Microsoft Outlook.com | Versions earlier than 20260925.100 |
| Windows 10 Version 1607 | 10.0.14393.0 through versions earlier than 10.0.14393.9612 |
| Windows 10 Version 1809 | 10.0.17763.0 through versions earlier than 10.0.17763.9376 |
| Windows 10 Version 21H2 | 10.0.19044.0 through versions earlier than 10.0.19044.7807 |
| Windows 10 Version 22H2 | Versions earlier than 10.0.19044.7807 as listed in the retrieved NVD data; verify the servicing-branch mapping with Microsoft |
| Windows 11 Version 23H2 | Versions earlier than 10.0.22631.7652 |
| Windows 11 Version 24H2 | Versions earlier than 10.0.26100.9711 |
| Windows 11 Version 25H2 | Versions earlier than 10.0.26200.9711 |
| Windows 11 Version 26H1 | Versions earlier than 10.0.28000.3231 |
| Windows 11 Version 26H2 | Versions earlier than 10.0.26300.9711 |
| Windows Server editions | Affected releases, including Server Core; verify exact build ranges in Microsoft’s advisory |
NVD data contains duplicate and inconsistent Windows version labels, particularly for Windows 10 Version 22H2 and Windows 11 releases. Compare the installed build with Microsoft’s Security Update Guide instead of relying on an operating-system marketing label or a generic vulnerability scanner result.
The Fix, If You’re in a Hurry
Patch affected systems with the applicable October 2026 Microsoft cumulative update. The retrieved package mappings identify KB5127648 for applicable Windows 11 versions 24H2, 25H2, and 26H2; KB5126657 for applicable Windows 10 servicing channels; and KB5126646 for Windows Server 2025. Confirm each package against the exact edition, architecture, servicing channel, and installed build before deployment.
A successful update transaction is not enough. Consider a system remediated only when its installed build is at or above the fixed build specified by Microsoft for that servicing branch. Microsoft’s Security Update Guide is authoritative for package applicability and fixed versions:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951
Technical Notes: Mitigation and upgrade commands
After obtaining the correct Microsoft update package through approved patch-management channels, an administrator can install a standalone package with DISM:
dism.exe /Online /Add-Package /PackagePath:C:\Updates\<approved-microsoft-update>.cab
shutdown.exe /r /t 0
Use the actual package downloaded and validated for the affected Windows release. In managed environments, deploy the applicable KB through Windows Update for Business, Configuration Manager, Intune, or the organization’s approved update platform. Confirm the resulting build with:
Get-ComputerInfo -Property WindowsProductName,WindowsVersion,OsBuildNumber
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10
If immediate patching is impossible, temporarily reduce exposure by blocking untrusted files and links from reaching Windows endpoints, strengthening email and messaging attachment controls, and restricting risky content to isolated analysis systems. These are compensating controls, not a replacement for patching.
Because CISA lists this CVE as actively exploited, organizations should not defer remediation while waiting for a public proof of concept. Endpoint teams may also consider layered malware protection, such as Malwarebytes, as a supplementary control. Security software does not replace Microsoft’s patch.
Analyst’s Take: Patch validation should come first because exploitation is confirmed and the affected version data contains inconsistent labels. Use Microsoft’s branch-specific fixed builds to confirm remediation, then investigate endpoints that processed suspicious files or links before patching.
How This Vulnerability Works
CVE-2026-96951 is caused by improper neutralization of special elements used in a command. Windows Shell can interpret attacker-controlled content as command syntax instead of treating it strictly as inert data. The result is a command-injection condition in which a crafted file, link, or related content can trigger unintended command processing.
The CVSS vector requires user interaction, so this is not described as a fully silent network compromise. A victim may need to open a file, click a link, or otherwise interact with attacker-delivered content. Available reporting also associates the vulnerability with bypassing Windows security protections such as Mark of the Web or related warning controls, but the precise implementation mechanism should be confirmed against Microsoft’s advisory.
The impact metrics are significant: confidentiality, integrity, and availability are all rated high. An attacker who successfully exploits the flaw could potentially read sensitive information, modify or destroy data, execute follow-on actions, or disrupt systems, depending on the security context and controls available on the target.
Severity, Explained
CVE-2026-96951 has a CVSS 3.1 base score of 8.8. The vector is:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Each component has an operational implication:
- AV:N: The attack can be delivered over a network, including through internet-connected services or attacker-controlled content delivered by email, messaging, web traffic, or shared resources.
- AC:L: Exploitation does not require unusual conditions or complex preparation.
- PR:N: The attacker does not need an account or existing privileges on the target.
- UI:R: A user must interact with the malicious content.
- S:U: The vulnerable Windows security authority and the affected security scope are treated as unchanged.
- C:H, I:H, A:H: Successful exploitation can have high confidentiality, integrity, and availability consequences.
The score is not a reason to wait for more evidence. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on October 13, 2026, with a federal remediation deadline of October 16, 2026. KEV status materially increases the operational priority beyond what the numeric CVSS score alone conveys.
Is It Being Exploited?
Yes. CISA’s KEV catalog confirms that CVE-2026-96951 is being exploited in the wild. The available catalog record does not identify a named threat actor, campaign, exploit sample, or specific victim set. It also marks known ransomware campaign use as Unknown, so defenders should not describe ransomware use as confirmed.
No verified public GitHub proof-of-concept repository was identified in the supplied primary-source research. That does not indicate that exploitation is difficult or theoretical. KEV inclusion establishes real-world exploitation even when a public exploit or reproducible proof of concept is unavailable.
Treat the absence of a public proof of concept as irrelevant to prioritization. Attackers may possess private exploit material, use weaponized files or links, or exploit the issue through delivery methods that are not visible in public repositories. Systems exposed to email, instant messaging, downloads, shared documents, and internet-originated content deserve particular attention.
Detecting It in Your Environment
Detection should combine patch validation, endpoint telemetry, file-origin metadata, shell process monitoring, and investigation of suspicious user interactions. No verified CVE-specific network signature appears in the available research, so a generic firewall rule or IDS pattern should not be treated as reliable detection for this vulnerability.
Prioritize endpoints that processed suspicious files or links before patching. Review activity involving Windows Shell, command interpreters, script hosts, and unusual child processes launched from user-facing applications. Examine events where files from the internet or messaging platforms were opened shortly before abnormal process execution or security-warning bypass activity.
For centralized monitoring, correlate endpoint events with log aggregation data from email gateways, proxies, browsers, authentication systems, and file-sharing platforms.
Technical Notes: Endpoint and log queries
In Microsoft Defender advanced hunting, this query can identify suspicious command interpreters launched by common user-facing applications. It is a triage query, not a CVE-specific exploit signature:
DeviceProcessEvents
| where Timestamp > ago(14d)
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe")
| where InitiatingProcessFileName in~ (
"outlook.exe", "winword.exe", "excel.exe", "powerpnt.exe",
"explorer.exe", "teams.exe", "chrome.exe", "msedge.exe", "firefox.exe"
)
| project Timestamp, DeviceName, AccountName, FileName,
ProcessCommandLine, InitiatingProcessFileName,
InitiatingProcessCommandLine, SHA1
| order by Timestamp desc
For environments using Sysmon, review Event ID 1 process-creation records for patterns such as:
ParentImage=.*\\(outlook|winword|excel|teams|explorer|chrome|msedge|firefox)\.exe
Image=.*\\(cmd|powershell|pwsh|wscript|cscript|mshta)\.exe
Also inspect Windows Security Event ID 4688 where process creation auditing is enabled. Correlate suspicious command execution with email gateway, proxy, browser-download, and endpoint file-origin logs. A relevant timeline includes a file or link received from an external source, user interaction, and a new shell or script process shortly afterward.
Response and Investigation Checklist
After deploying the applicable update, security teams should:
- Confirm the installed Windows build against Microsoft’s fixed build for the relevant servicing branch.
- Identify endpoints that opened suspicious files, links, email attachments, or instant messages before patching.
- Review process-creation events for shell and script interpreters launched by user-facing applications.
- Search for unexpected persistence, credential access, lateral movement, or security-control changes.
- Preserve endpoint, email, proxy, authentication, and process telemetry before rotating or deleting evidence.
- Isolate systems showing suspicious post-interaction activity and begin incident response procedures.
- Record the affected asset, installed build, update package, deployment time, and validation result.
Patching reduces future exposure but does not prove that a system was not previously compromised.
References and Further Reading
Microsoft’s Security Update Guide is the primary source for fixed builds, affected editions, update packages, and installation guidance:
The NVD record provides the vulnerability description, CVSS information, and affected-product data. Because the retrieved product ranges contain duplicate or inconsistent labels, use it alongside Microsoft’s branch-specific advisory:
CISA’s Known Exploited Vulnerabilities catalog confirms exploitation in the wild and provides the October 16, 2026 federal remediation deadline and related required actions:
Where applicable, organizations should also follow CISA’s forensic triage guidance after patching. Preserve relevant endpoint, email, proxy, authentication, and process telemetry before rotating or deleting evidence. Patch deployment should be followed by targeted investigation, not treated as proof that prior exploitation did not occur.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.