CVE-2026-96951
Microsoft Windows Command Injection Vulnerability
Microsoft WindowsOperating systems
CVSS
8.8HighExploit odds (EPSS)1.51%Chance of exploitation activity in the next 30 days, higher than 74% of CVEs. Scored 23 Oct 2026FIRST EPSS
CISA required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. CISA KEV
Patching is not enoughCISA requires federal agencies to look for signs of compromise on affected systems, not only patch (forensic triage under BOD 26-04). Treat exposed systems as possibly compromised. CISA guidance
What fixes it
- 20260925.100Outlook.comCVE List
- 10.0.14393.9612Windows 10 Version 1607CVE List
- 10.0.17763.9376Windows 10 Version 1809CVE List
- 10.0.19044.7807Windows 10 Version 21H2CVE List
- 10.0.19045.7807Windows 10 Version 22H2CVE List
- 10.0.22631.7652Windows 11 version 23H2CVE List
Show all 20 fixed versions
- 10.0.22631.7652Windows 11 Version 23H2CVE List
- 10.0.26100.9711Windows 11 Version 24H2CVE List
- 10.0.26200.9711Windows 11 Version 25H2CVE List
- 10.0.28000.3231Windows 11 version 26H1CVE List
- 10.0.26300.9711Windows 11 Version 26H2CVE List
- 6.3.9600.23470Windows Server 2012 R2CVE List
- 6.3.9600.23470Windows Server 2012 R2 (Server Core installation)CVE List
- 10.0.14393.9612Windows Server 2016CVE List
- 10.0.14393.9612Windows Server 2016 (Server Core installation)CVE List
- 10.0.17763.9376Windows Server 2019CVE List
- 10.0.17763.9376Windows Server 2019 (Server Core installation)CVE List
- 10.0.20348.5761Windows Server 2022CVE List
- 10.0.26100.33650Windows Server 2025CVE List
- 10.0.26100.33650Windows Server 2025 (Server Core installation)CVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Timeline
- 13 Oct 2026Added to CISA KEVCISA KEV
- 13 Oct 2026, 19:01 UTCPublishedCVE List
- 13 Oct 2026, 23:24 UTCFirst reported exploitedKrebs on Security
Vendor and government advisories 1
Vendors that say their products are affected, and agencies that issued alerts. Check each for the fixed release of the product you run.
Reports 7
5 outlets report exploitation. Reports are not confirmation; each links to its source.
- @zoomeyebot.bsky.social: CVE-2026-96951 Windows Shell CWE-77, CVSS 8.8, exploited in the wild. app="Microsoft Exchange" && title="Outlook" = 22,517 matched assets ZoomEye Read https://zoomeye.ai/agent.md aBluesky: exploited in the wild, 23 Oct 2026Exploitation reported
- @pixcel25.bsky.social: On Oct 13, Microsoft fixed over 1,400 vulnerabilities in one release, more than in any previous full year. The exact count varies by tracker (1,411 to 1,416). One Windows Shell zerBluesky: zero-day, 19 Oct 2026Exploitation reportedZero-day
- @cybernewsdaily.bsky.social: CISA mandates emergency patch for Windows Shell zero-day CVE-2026-96951. Adversaries exploiting evasion technique Sponsor this channel today. https://www.ProNetGrowth.com/cyber/?utBluesky: zero-day, 18 Oct 2026Zero-day
- @theperimetersite.bsky.social: Federal agencies have until today to patch the Ivanti Connect Secure authentication bypass (CVE-2026-104935) and the Microsoft Windows command injection flaw (CVE-2026-96951). The Bluesky: zero-day, 16 Oct 2026
- Microsoft Patches More Than 1,400 Security FlawsKrebs on Security, 13 Oct 2026Exploitation reportedZero-day
- Patch Tuesday - October 2026Rapid7, 13 Oct 2026
- CVE-2026-96951 Windows Shell Security Feature Bypass VulnerabilityMicrosoft Security Update Guide, 13 Oct 2026
Description
Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.
Text from CVE List
Affected versions 20
- Outlook.comaffected: 1.0.0 before 20260925.100CVE List
- Windows 10 Version 1607affected: 10.0.14393.0 before 10.0.14393.9612CVE List
- Windows 10 Version 1809affected: 10.0.17763.0 before 10.0.17763.9376CVE List
- Windows 10 Version 21H2affected: 10.0.19044.0 before 10.0.19044.7807CVE List
- Windows 10 Version 22H2affected: 10.0.19045.0 before 10.0.19045.7807CVE List
- Windows 11 version 23H2affected: 10.0.22631.0 before 10.0.22631.7652CVE List
- Windows 11 Version 23H2affected: 10.0.22631.0 before 10.0.22631.7652CVE List
- Windows 11 Version 24H2affected: 10.0.26100.0 before 10.0.26100.9711CVE List
- Windows 11 Version 25H2affected: 10.0.26200.0 before 10.0.26200.9711CVE List
- Windows 11 version 26H1affected: 10.0.28000.0 before 10.0.28000.3231CVE List
- Windows 11 Version 26H2affected: 10.0.26300.0 before 10.0.26300.9711CVE List
- Windows Server 2012 R2affected: 6.3.9600.0 before 6.3.9600.23470CVE List
- Windows Server 2012 R2 (Server Core installation)affected: 6.3.9600.0 before 6.3.9600.23470CVE List
- Windows Server 2016affected: 10.0.14393.0 before 10.0.14393.9612CVE List
- Windows Server 2016 (Server Core installation)affected: 10.0.14393.0 before 10.0.14393.9612CVE List
- Windows Server 2019affected: 10.0.17763.0 before 10.0.17763.9376CVE List
- Windows Server 2019 (Server Core installation)affected: 10.0.17763.0 before 10.0.17763.9376CVE List
- Windows Server 2022affected: 10.0.20348.0 before 10.0.20348.5761CVE List
- Windows Server 2025affected: 10.0.26100.0 before 10.0.26100.33650CVE List
- Windows Server 2025 (Server Core installation)affected: 10.0.26100.0 before 10.0.26100.33650CVE List
References 4
- msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951Fixvia CVE List
- msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-96951Referencevia CISA KEV
- nvd.nist.gov/vuln/detail/CVE-2026-96951Referencevia CISA KEV
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96951Referencevia CVE List