CVE-2026-96951
8.8 high
KEV · due 2026-10-16
Microsoft: exploited
SSVC exploitation: active
Analyzed
Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
Fix
Microsoft's update · Important · exploited
- KB5126836 — Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) · build 6.3.9600.23470 · restart required
- KB5126868 — Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation) · build 10.0.14393.9612 · restart required
- KB5126651 — Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation) · build 10.0.17763.9376 · restart required
- KB5126657 — Windows 10 Version 21H2 for 32-bit Systems, Windows 10 Version 21H2 · build 10.0.19044.7807 · restart required
- KB5126657 — Windows 10 Version 22H2 for 32-bit Systems, Windows 10 Version 22H2 · build 10.0.19045.7807 · restart required
- KB5126655 — Windows Server 2022, Windows Server 2022 (Server Core installation) · build 10.0.20348.5761 · restart required
- KB5126653 — Windows 11 Version 23H2 · build 10.0.22631.7652 · restart required
- KB5127648 — Windows 11 Version 24H2 · build 10.0.26100.9711 · restart required
- KB5127648 — Windows 11 Version 25H2 · build 10.0.26200.9711 · restart required
- KB5127648 — Windows 11 Version 26H2 · build 10.0.26300.9711 · restart required
- KB5126646 — Windows Server 2025, Windows Server 2025 (Server Core installation) · build 10.0.26100.33650 · restart required
- KB5127646 — Windows 11 Version 26H1, Windows 11 version 26H1 · build 10.0.28000.3231 · restart required
- Release Notes — Outlook.com · build 20260925.100 · restart required
- Release Notes — Microsoft Edge (Chromium-based) · build 154.0.4258.62
From the 2026-Oct release note of Microsoft's Security Update Guide, revised 2026-10-28 · Exploitation Detected.
CISA KEV required action · due 2026-10-16
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Added to the catalog 2026-10-13. CISA KEV
Patch, vendor advisory and mitigation references on NVD 1
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951 Patch, Vendor Advisory
Vendor advisories in the News 1
- Microsoft October 2026 Security Updates: 1476 CVEs, 1 exploited, 96 critical Microsoft Security Update Guide · 2026-10-13
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
In the news 7
- Microsoft Releases 1,400+ Patches and “Risk Cohorts” System SANS NewsBites · 2026-10-14
- Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day SecurityWeek · 2026-10-14
- Microsoft Patches More Than 1,400 Security Flaws Krebs on Security · 2026-10-13
- Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities Cisco Talos Intelligence · 2026-10-13
- Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities Cisco Talos blog · 2026-10-13
- October 2026 Microsoft Patch Tuesday, (Tue, Oct 13th) SANS Internet Storm Center · 2026-10-13
- CISA Adds Two Known Exploited Vulnerabilities to Catalog CISA advisories and alerts · 2026-10-13
Change history 1
- First seenCVSS 8.8 · in KEV · microsoftNVD modified 2026-10-14 18:24
Affected (CPE criteria) 26
cpe:2.3:a:microsoft:outlook_web:-:*:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:*cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:*cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x86:*cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:*cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:*cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:*cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:arm64:*cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:x64:*cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:arm64:*cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:x64:*cpe:2.3:o:microsoft:windows_11_26h2:*:*:*:*:*:*:arm64:*cpe:2.3:o:microsoft:windows_11_26h2:*:*:*:*:*:*:x64:*cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:x64:*
References 2
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951 Patch, Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96951 US Government Resource