Command Injection Vulnerability in Windows Shell by Microsoft
CVE-2026-96951

8.8HIGH

Key Information:

Vendor

Microsoft
Status
Outlook.com
Windows 10 Version 1607
Windows 10 Version 1809
Windows 10 Version 21h2
Vendor
CVE Published:
13 October 2026

Badges

🔥 Trending now📈 Trended📈 Score: 2,650👾 Exploit Exists🦅 CISA Reported📰 News Worthy

What is CVE-2026-96951?

CVE-2026-96951 is a command injection vulnerability found in Windows Shell, a component of the Microsoft Windows operating system that allows users to interact with the system through command-line input. This vulnerability stems from improper handling of special elements used in commands, potentially giving unauthorized attackers the ability to bypass security restrictions over a network. This flaw can enable attackers to execute arbitrary commands, which might lead to unauthorized modifications of system settings, data breaches, or full system control. Given that Windows Shell is an integral part of countless organizational infrastructures, the impact of this vulnerability can be both extensive and severe.

Potential impact of CVE-2026-96951

  1. Unauthorized Access: Attackers exploiting this vulnerability could gain unauthorized access to sensitive systems and data, leading to significant data leaks and compromise of confidential information.

  2. System Integrity Compromise: By allowing command execution, this vulnerability risks the integrity of affected systems. Attackers could alter critical configurations, deploy malware, or establish persistent access, threatening overall system functionality.

  3. Network Security Breach: The ability to bypass security features could facilitate broader attacks within an organization's network, enabling lateral movement to other systems and increased risk of widespread ransomware deployment or other malicious activities.

CISA has reported CVE-2026-96951

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2026-96951 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Affected Version(s)

Outlook.com 1.0.0 < 20260925.100

Windows 10 Version 1607 32-bit Systems 10.0.14393.0 < 10.0.14393.9612

Windows 10 Version 1809 32-bit Systems 10.0.17763.0 < 10.0.17763.9376

News Articles

favicon imageThe Hacker News

Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug

Microsoft patched a record 1,413 flaws, including an exploited Windows Shell bug that can bypass Mark of the Web defenses.

14 hours ago

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • 📈

    Vulnerability started trending

  • 📰

    First article discovered by The Hacker News

  • 👾

    Exploit known to exist

  • 🦅

    CISA Reported

  • Vulnerability published

  • Vulnerability Reserved

.