U.S. CISA adds Microsoft Windows Shell flaw to its Known Exploited Vulnerabilities catalog
CISA added actively exploited Windows Shell flaw CVE-2026-96951 to the KEV catalog.
CISA added Microsoft Windows Shell flaw CVE-2026-96951, CVSS 8.8, to the Known Exploited Vulnerabilities catalog. Microsoft's October 2026 updates addressed a reported 1,415 vulnerabilities, including this command-injection bug, which can bypass Mark of the Web when a user opens a crafted file from email or messaging or follows a malicious link. Microsoft confirmed active exploitation, and federal agencies must fix it by October 16, 2026. CISA also added Ivanti Connect Secure authentication-bypass CVE-2026-104935, CVSS 8.6, which can let an unauthenticated remote attacker run commands on affected versions before 25.1.3.0.
- CVE-2026-96951 is an actively exploited Windows Shell MOTW bypass.
- Exploitation requires a user to open a link or attachment.
- Federal agencies must remediate by October 16, 2026.
- CISA also listed Ivanti Connect Secure CVE-2026-104935.
Vulnerabilities mentionedAll →
- CVE-2026-1049358.626%Auth Bypass to Command Execution in Ivanti Connect Securepublished · Ivanti Connect Secure KEV PoC ×2
Full article367 words · extracted from securityaffairs.com · click to collapse
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft Windows Shell flaw to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Microsoft Windows Shell flaw, tracked as CVE-2026-96951 (CVSS score of 8.8), to its Known Exploited Vulnerabilities (KEV) catalog.
Microsoft Patch Tuesday security updates for October 2026 address a record 1,415 vulnerabilities, including a zero-day under active attack. The flaw, tracked as CVE-2026-96951, is a Windows Shell command injection vulnerability that allows an unauthorized attacker to bypass security protections over a network. Exploitation can evade Mark of the Web (MOTW) defenses, which help protect users from potentially dangerous files downloaded from the internet. Microsoft confirmed that the flaw is being actively exploited.
“An attacker who successfully exploited the vulnerability could evade Mark of the Web (MOTW) defenses.” reads the advisory. “In an email or instant message attack scenario, the attacker could send the targeted user a specially crafted file that is designed to exploit the vulnerability. In any case an attacker would have no way to force a user to view attacker-controlled content. Instead, an attacker would have to convince a user to take action. For example, an attacker could entice a user to either click a link that directs the user to the attacker’s site or send a malicious attachment.”
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix the flaw by October 16, 2026.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) also added an Ivanti Connect Secure FortiMail flaw, tracked as CVE-2026-104935 (CVSS score of 8.6), to its Kev Catalog.
The vulnerability is an authentication bypass issue caused by spoofing in ICS versions before 25.1.3.0 that could allow a remote, unauthenticated attacker to execute arbitrary commands. ICS versions 22.7R2.14 and earlier are not affected.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)