Command Injection Vulnerability in Windows Shell by Microsoft
CVE-2026-96951

8.8HIGH

Key Information:

Vendor

Microsoft
Status
Microsoft Edge (chromium-based)
Outlook.com
Windows 10 Version 1607
Windows 10 Version 1809
Vendor
CVE Published:
13 October 2026

Badges

📈 Trended📈 Score: 4,160💰 Ransomware👾 Exploit Exists🦅 CISA Reported📰 News Worthy

What is CVE-2026-96951?

CVE-2026-96951 is a command injection vulnerability found in Windows Shell, a component of the Microsoft Windows operating system that allows users to interact with the system through command-line input. This vulnerability stems from improper handling of special elements used in commands, potentially giving unauthorized attackers the ability to bypass security restrictions over a network. This flaw can enable attackers to execute arbitrary commands, which might lead to unauthorized modifications of system settings, data breaches, or full system control. Given that Windows Shell is an integral part of countless organizational infrastructures, the impact of this vulnerability can be both extensive and severe.

Potential impact of CVE-2026-96951

  1. Unauthorized Access: Attackers exploiting this vulnerability could gain unauthorized access to sensitive systems and data, leading to significant data leaks and compromise of confidential information.

  2. System Integrity Compromise: By allowing command execution, this vulnerability risks the integrity of affected systems. Attackers could alter critical configurations, deploy malware, or establish persistent access, threatening overall system functionality.

  3. Network Security Breach: The ability to bypass security features could facilitate broader attacks within an organization's network, enabling lateral movement to other systems and increased risk of widespread ransomware deployment or other malicious activities.

CISA has reported CVE-2026-96951

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2026-96951 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace as recent news articles suggest the vulnerability is being used by ransomware groups.

The CISA's recommendation is: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Affected Version(s)

Microsoft Edge (Chromium-based) 1.0.0.0 < 154.0.4258.62

Outlook.com 1.0.0 < 20260925.100

Windows 10 Version 1607 32-bit Systems 10.0.14393.0 < 10.0.14393.9612

News Articles

favicon imageInformation Queue

Microsoft's October Security Update Fixes 1,400+ Vulnerabilities, One Exploited in the Wild

Microsoft's latest monthly security update addresses 1415 vulnerabilities across multiple products. One vulnerability affecting Windows Shell has been exploited in the wild, while 85 are classified as

1 week ago

favicon imageHelp Net Security

Week in review: Hidden implant in Ledger wallets linked to $93M theft, 1,500+ npm packages exposed - Help Net Security

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Strands Box: Open-source sandbox for AI agents AWS

3 weeks ago

favicon imageManageengine

Lessons from Microsoft’s October 2026 Patch Tuesday

October 2026 Patch Tuesday fixes 1413 CVEs, including a MOTW bypass zero-day. See four lessons from Patch Manager Plus to sharpen your patching before November.

3 weeks ago

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

EPSS Score

9% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • 💰

    Used in Ransomware

  • 📈

    Vulnerability started trending

  • 📰

    First article discovered by Securityweek

  • 👾

    Exploit known to exist

  • 🦅

    CISA Reported

  • Vulnerability published

  • Vulnerability Reserved

.