Windows Shell command injection bypasses a security feature
CISA: Microsoft Windows Command Injection Vulnerability
CVSS 3.1
8.8high
EPSS
2%p74
Published
()
KEV added
AI analysis
CVE-2026-96951 is a command-injection flaw (CWE-77) in the Windows Shell in which special elements in a command are not properly neutralized. An unauthorized attacker can trigger it remotely with no prior privileges if a user interacts with attacker-controlled content, and Microsoft describes the result as bypassing a security feature; the CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) rates confidentiality, integrity, and availability impacts as high. Affected products named in the data are Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), Windows Server 2012 and 2016, and Outlook on the web. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-10-13, so exploitation in the wild is confirmed; ransomware use is listed as unknown and no public proof-of-concept is known.
What to do: Apply Microsoft's security updates for every listed Windows and Outlook on the web build as soon as they are available, and follow CISA BOD 26-04 (including cloud guidance or discontinuation if a mitigation is unavailable). Prioritize internet-facing and high-value assets, and because exploitation needs user interaction, reinforce phishing-resistant handling of untrusted content while you patch.
Affected
Microsoft Windows 10
1607, 1809, 21H2, 22H2
Microsoft Windows 11
23H2, 24H2, 25H2, 26H1, 26H2
Microsoft Windows Server
2012, 2016
Microsoft Outlook on the web
affected as identified by Microsoft (no narrower range in the advisory data)
Estimated exposure
masson the order of hundreds of millions of Windows endpoints and Outlook on the web users — Estimate from the very large global install base of Windows 10/11 and Windows Server plus widespread Microsoft 365 / Outlook on the web use, not from a device-scan count; exact vulnerable builds are not quantified in the data.
Description
Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
CISA Known Exploited Vulnerability
Affected
Microsoft Windows
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
outlook web, windows 10 1607, windows 10 1809, windows 10 21h2, windows 10 22h2, windows 11 23h2, windows 11 24h2, windows 11 25h2, windows 11 26h1, windows 11 26h2, windows server 2012, windows server 2016
Microsoft's October Patch Tuesday fixes 1,413 flaws, including an actively exploited Windows Shell zero-day.
Microsoft's October Patch Tuesday addresses a record 1,413 vulnerabilities, including the actively exploited Windows Shell flaw CVE-2026-96951 (CVSS 8.8). The bug bypasses Mark of the Web warnings but requires a user to open a crafted file or link. Two other flaws were publicly disclosed before patching: CVE-2026-108398 (CVSS 8.8), an untrusted .NET Framework search path that can bypass Windows Defender Application Control, and CVE-2026-92707 (CVSS 5.3), a MessagePack-CSharp issue that can let a remote attacker exhaust memory. Microsoft attributes the rising fix volume partly to greater use of AI in vulnerability discovery.
Microsoft's October 2026 Patch Tuesday fixes 1,413 CVEs, including an exploited Windows Shell zero-day.
Microsoft's October 2026 Patch Tuesday addresses 1,413 CVEs, including 80 critical flaws, exceeding September's 974. Two zero-days are security bypasses: actively exploited CVE-2026-96951 (CVSS 8.8) in Windows Shell, and CVE-2026-108398 in .NET Framework. Windows accounts for 1,102 flaws, with others affecting Office, developer tools, SharePoint, SQL Server, Exchange, Azure, and Defender. Microsoft also republished CVE-2026-21413, a Cisco Talos raw-image-extension remote code execution vulnerability. Fortra noted that 26 Microsoft CVEs from 2026 appear in CISA's Known Exploited Vulnerabilities catalog.
Microsoft's October Patch Tuesday fixes 1,413 flaws, including exploited Windows Shell bypass CVE-2026-96951.
Microsoft's October 2026 Patch Tuesday addresses 1,413 vulnerabilities, more than its previous annual record of 1,261 CVEs in 2020. About 1,102 affect Windows, with 134 in Office, 61 in developer tools, and 36 in SharePoint Server. One high-severity Windows Shell flaw, CVE-2026-96951, is actively exploited to bypass a security feature and is the third Windows Shell bug exploited in 2026. Microsoft also introduced risk cohorts to help customers prioritize the unusually large update.
Microsoft's October 2026 updates fix 1,415 CVEs, including an exploited Windows Shell zero-day.
Microsoft's October 2026 Patch Tuesday addresses a record 1,415 CVEs across Windows, Office, SharePoint, SQL Server, Azure, Exchange, and other products, according to the Zero Day Initiative. Microsoft confirmed active exploitation of CVE-2026-96951, a Windows Shell flaw rated CVSS 8.8 that can bypass Mark of the Web when a user opens a crafted file. Other priorities include unauthenticated SharePoint privilege escalation CVE-2026-102866 (CVSS 8.1), SQL Server remote code execution CVE-2026-65674 (CVSS 8.8), and 59 potentially wormable bugs in services such as DHCP, Remote Desktop Gateway, and DNS. Microsoft also introduced risk cohorts to group related flaws.
Microsoft's October 2026 Patch Tuesday fixes 1,414 flaws, including exploited Windows Shell bypass CVE-2026-96951.
Qualys reviews Microsoft's October 2026 Patch Tuesday, its largest release, covering 1,414 vulnerabilities including 78 critical and 1,329 important issues. Two zero-days are patched; CVE-2026-96951, a Windows Shell security-feature bypass reachable over the network, is actively exploited and was added to CISA's Known Exploited Vulnerabilities catalog, with patching urged before October 16, 2026. CVE-2026-108398 is a local .NET Framework security-feature bypass. Critical fixes include unauthenticated remote code execution in Microsoft QUIC, Exchange Server, Windows Message Queuing, Media Foundation, and related Windows components.
Microsoft's October 2026 Patch Tuesday fixes 1,411 CVEs, including one actively exploited Windows Shell bypass.
Microsoft's October 13, 2026 Patch Tuesday fixed 1,411 CVEs, more than the just over 1,100 updates released in all of 2025, which the company has tied to AI-assisted discovery including its MDASH scanning harness. One flaw, CVE-2026-96951, a Windows Shell security-feature bypass scored CVSS 8.8, is actively exploited and can be triggered by a user opening a crafted file from email, chat, or a website. Two publicly disclosed but not yet exploited issues are CVE-2026-108398, a .NET bypass of Windows Defender Application Control, and CVE-2026-92707, a network denial of service in MessagePack-CSharp. Of 70 critical bugs, 57 are remote code execution, including Outlook Reading Pane flaw CVE-2026-70242 at CVSS 9.8, which can trigger from preview alone.
Microsoft patched a record 1,413 flaws, including exploited Windows Shell bug CVE-2026-96951 now on CISA’s KEV list.
Microsoft’s October 2026 Patch Tuesday fixed 1,413 vulnerabilities, including 1,102 in Windows, 134 in Office, 36 in SharePoint Server, and 22 in SQL Server, with more than 70 rated Critical. CVE-2026-96951 (CVSS 8.8), a Windows Shell command-injection flaw that can bypass Mark of the Web, is exploited in the wild and is in CISA’s KEV catalog, with a federal deadline of October 16, 2026. Publicly known CVE-2026-108398 can bypass WDAC, while CVE-2026-92707 and non-Microsoft CVE-2026-21413 (CVSS 9.8) in Raw Image Extension, which can lead to remote code execution via thumbnails, were also patched. Tenable said Microsoft has patched more than 4,000 CVEs this year.
Microsoft's October Patch Tuesday fixes 1,407 CVEs, including an exploited Windows Shell Mark-of-the-Web bypass.
Microsoft's October 2026 Patch Tuesday covers a record 1,407 CVEs, including three zero-days. Exploited CVE-2026-96951 bypasses Windows Shell Mark of the Web; SharePoint CVE-2026-102866 can hijack accounts via token validation, and CVE-2026-108398 can bypass Windows Defender Application Control. Separately, self-managed GitLab CVE-2026-97229, IBM i CVE-2026-96119 (CVSS 9.9), and Atlassian CVE-2026-21589—with exploitation attempts reported from October 6—require urgent patching. Researchers also flagged 55 wormable Microsoft CVEs and four high-severity on-premises Exchange fixes.
CISA added actively exploited Windows Shell flaw CVE-2026-96951 to the KEV catalog.
CISA added Microsoft Windows Shell flaw CVE-2026-96951, CVSS 8.8, to the Known Exploited Vulnerabilities catalog. Microsoft's October 2026 updates addressed a reported 1,415 vulnerabilities, including this command-injection bug, which can bypass Mark of the Web when a user opens a crafted file from email or messaging or follows a malicious link. Microsoft confirmed active exploitation, and federal agencies must fix it by October 16, 2026. CISA also added Ivanti Connect Secure authentication-bypass CVE-2026-104935, CVSS 8.6, which can let an unauthenticated remote attacker run commands on affected versions before 25.1.3.0.
Microsoft’s October 2026 Patch Tuesday fixes 1,407 CVEs, including an exploited Windows Shell zero-day.
Microsoft’s October 2026 Patch Tuesday fixes 1,407 CVEs across 301 products, including 69 critical and 1,337 important issues, with elevation of privilege and remote code execution the largest categories. CVE-2026-96951, a Windows Shell Mark of the Web bypass scored 8.8, was exploited in the wild; CVE-2026-108398, a .NET Framework control bypass, was publicly disclosed. Critical bugs include Active Directory Domain Services RCE CVE-2026-70229 and Exchange RCE CVE-2026-70571, both rated exploitation more likely. Extended Security Updates for Windows Server 2012 and 2012 R2 ended on October 13.
Microsoft's October 2026 Patch Tuesday patches 1,417 flaws, including an already exploited Windows Shell bypass.
Microsoft's October 2026 Patch Tuesday covers 1,417 vulnerabilities, including 76 rated critical and seven critical issues requiring no customer action. CVE-2026-96951, a Windows Shell security-feature bypass already exploited in the wild, can remove Mark of the Web from content sent by email or instant message, although the recipient must still open the file. CVE-2026-108398, a .NET application-control bypass, was disclosed before release but Microsoft has not seen exploitation. The release also includes 10 Windows DHCP Server remote-code-execution flaws, five critical, and Exchange CVE-2026-70571, a high-complexity RCE triggered when a crafted email is processed during content conversion.
Microsoft patched over 1,400 flaws, including an exploited Windows Shell bypass, CVE-2026-96951.
Microsoft released fixes for more than 1,400 vulnerabilities, far above September’s nearly 1,000 and the 1,261 patched in all of 2020. One issue, CVE-2026-96951, is a Windows Shell security-feature bypass affecting Windows 10, Windows 11, and some Server versions and is already exploited. At least 78 flaws are rated critical, mostly enabling code execution. CVE-2026-108398, a .NET Framework security-feature bypass, was publicly disclosed before the patches but has no observed exploitation. Tenable notes Microsoft has passed 4,000 CVEs this year, while only 26 Microsoft bugs have entered CISA’s KEV catalog so far.
CISA added actively exploited Microsoft Windows and Ivanti Connect Secure flaws to the KEV catalog.
CISA added two vulnerabilities to the Known Exploited Vulnerabilities Catalog after finding evidence of active exploitation. They are CVE-2026-96951, a Microsoft Windows command-injection vulnerability, and CVE-2026-104935, an Ivanti Connect Secure authentication-bypass-by-spoofing vulnerability. Binding Operational Directive 26-04 requires federal civilian agencies to prioritize remediation of KEV entries on publicly exposed assets that can give total control. CISA also urges other organizations to patch cataloged flaws first.
Microsoft's October 2026 Patch Tuesday fixes 1,415 flaws, including 85 critical, with one Windows Shell bug exploited in the wild.
Microsoft's October 2026 Patch Tuesday addresses 1,415 vulnerabilities, 85 of them critical, across Windows, Office, Exchange, Hyper-V, and other products. Cisco Talos says CVE-2026-96951, a Windows Shell command-injection flaw scored 8.8, is already exploited. Sixty-seven critical bugs allow remote code execution, including CVSS 9.8 issues in Message Queuing, Microsoft QUIC, Text Shaping, and the PostScript printer driver. Microsoft rates Active Directory CVE-2026-70229 and Exchange CVE-2026-70571 as more likely to be exploited.
Canada's Cyber Centre urges patching Microsoft's October 2026 updates after exploited CVE-2026-96951 entered CISA's KEV.
The Canadian Centre for Cyber Security issued advisory AV26-1038 on Microsoft's October 13, 2026 monthly security rollup, listing vulnerabilities across Windows, Office, Exchange, SharePoint, SQL Server, .NET, Azure, and many other products. Microsoft indicated that CVE-2026-96951 has been exploited, and CISA added it to the Known Exploited Vulnerabilities catalog the same day. The Cyber Centre urges administrators to review Microsoft's updates and apply the available patches and mitigations.