Loading0%
SUBZER0
LIVE

CVE-2026-96951

Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.

  • Severity: High
  • CVSS 8.8
  • EPSS 1.51%
  • On CISA KEV
  • P1 · Patch now

Why P1: on CISA KEV.

Description

Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.

CISA Known Exploited Vulnerability

Added 2026-10-13, remediation due 2026-10-16. Ransomware use: Unknown. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for…

Affected products

  • microsoft outlook web Version details not specified in source
  • Microsoft Windows Version details not specified by CISA
  • microsoft windows 10 1607 < 10.0.14393.9612
  • microsoft windows 10 1607 < 10.0.14393.9612
  • microsoft windows 10 1809 < 10.0.17763.9376
  • microsoft windows 10 1809 < 10.0.17763.9376
  • microsoft windows 10 21h2 < 10.0.19044.7807
  • microsoft windows 10 21h2 < 10.0.19044.7807
  • microsoft windows 10 21h2 < 10.0.19044.7807
  • microsoft windows 10 22h2 < 10.0.19045.7807
  • microsoft windows 10 22h2 < 10.0.19045.7807
  • microsoft windows 10 22h2 < 10.0.19045.7807
  • microsoft windows 11 23h2 < 10.0.22631.7652
  • microsoft windows 11 23h2 < 10.0.22631.7652
  • microsoft windows 11 24h2 < 10.0.26100.9711
  • microsoft windows 11 24h2 < 10.0.26100.9711
  • microsoft windows 11 25h2 < 10.0.26200.9711
  • microsoft windows 11 25h2 < 10.0.26200.9711
  • microsoft windows 11 26h1 < 10.0.28000.3231
  • microsoft windows 11 26h1 < 10.0.28000.3231

Weakness

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

Published 2026-10-13 · updated 2026-10-16 · sources: NVD, GitHub Advisory Database, CISA KEV