CVE-2026-96951: Microsoft Windows Shell Command Injection (KEV)

CVE-2026-96951 is a command injection flaw in the Windows Shell (CWE-77) that lets an unauthorized attacker bypass a security feature over a network once a user is induced to interact with a crafted file or link, and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-10-13 after confirming active exploitation.

CVE-2026-96951 is an improper neutralization of special elements used in a command (CWE-77) in the Windows Shell. NVD's description states it "allows an unauthorized attacker to bypass a security feature over a network" (NVD).

NVD lists the CVE as "Analyzed" with a CVSS v3.1 base score of 8.8 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges required, but requiring user interaction, with high impact to confidentiality, integrity and availability (NVD).

NVD's configuration data lists affected products across Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) on x86/x64/ARM64, and Windows Server 2012 R2 through 2025, with the fix delivered in the October 2026 cumulative update; the Microsoft Security Response Center advisory page for this CVE renders its content via client-side JavaScript and could not be retrieved as static text this run, so this page relies on NVD and CISA data rather than presenting unverified vendor text (NVD).

CISA added CVE-2026-96951 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-10-13, with a required-action due date of 2026-10-16 under Binding Operational Directive 26-04, and lists known ransomware campaign use as "Unknown" (CISA KEV).

As of 2026-10-26, FIRST scores the probability of exploitation at 0.0981 (95.5th percentile) (FIRST EPSS).

Because exploitation requires user interaction (such as opening a crafted file), the practical mitigation is the same as for any actively exploited Windows Shell flaw: apply the October 2026 cumulative update immediately and treat unexpected file or link prompts from untrusted sources with suspicion in the meantime.

• Command injection in the Windows Shell lets an unauthorized attacker bypass a security feature over a network, requiring user interaction (CWE-77). — NVD
• CVSS v3.1 base score is 8.8 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, per NVD status Analyzed. — NVD
• Affects Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012 R2 through 2025; fixed by the October 2026 cumulative update. — NVD
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-10-13, due date 2026-10-16, active exploitation confirmed, known ransomware campaign use listed as Unknown. — CISA KEV
• EPSS score is 0.0981 (95.5th percentile) as of 2026-10-26. — FIRST EPSS