{"id":"CVE-2026-96951","kind":"vulnerability","aliases":["CVE-2026-96951"],"related":[],"title":"Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an…","description":"Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"Windows Shell command injection (CWE-77) lets an attacker evade Mark of the Web (MOTW) protections. The user must open a crafted file or link, delivered by email, chat or a download. Microsoft rates it Important, CVSS 8.8, and reports exploitation detected. Fixed in the Oct 13 2026 Patch Tuesday updates. CISA lists it as exploited.","severity":"high","cvss":8.8,"epss":null,"exploited":true,"exploited_at":"2026-10-13T00:00:00+00:00","products":[{"name":"Microsoft Windows","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9711"],"affected":"< 10.0.26100.9711","ecosystem":"vendor"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3231"],"affected":"< 10.0.28000.3231","ecosystem":"vendor"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7807"],"affected":"< 10.0.19045.7807","ecosystem":"vendor"},{"name":"Windows Server 2025","fixed":["10.0.26100.33650"],"affected":"< 10.0.26100.33650","ecosystem":"vendor"},{"name":"microsoft outlook web","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows 10 1607","fixed":["10.0.14393.9612"],"affected":"< 10.0.14393.9612","ecosystem":"vendor"},{"name":"microsoft windows 10 1809","fixed":["10.0.17763.9376"],"affected":"< 10.0.17763.9376","ecosystem":"vendor"},{"name":"microsoft windows 10 21h2","fixed":["10.0.19044.7807"],"affected":"< 10.0.19044.7807","ecosystem":"vendor"},{"name":"microsoft windows 10 22h2","fixed":["10.0.19045.7807"],"affected":"< 10.0.19045.7807","ecosystem":"vendor"},{"name":"microsoft windows 11 23h2","fixed":["10.0.22631.7652"],"affected":"< 10.0.22631.7652","ecosystem":"vendor"},{"name":"microsoft windows 11 24h2","fixed":["10.0.26100.9711"],"affected":"< 10.0.26100.9711","ecosystem":"vendor"},{"name":"microsoft windows 11 25h2","fixed":["10.0.26200.9711"],"affected":"< 10.0.26200.9711","ecosystem":"vendor"},{"name":"microsoft windows 11 26h1","fixed":["10.0.28000.3231"],"affected":"< 10.0.28000.3231","ecosystem":"vendor"},{"name":"microsoft windows 11 26h2","fixed":["10.0.26300.9711"],"affected":"< 10.0.26300.9711","ecosystem":"vendor"},{"name":"microsoft windows server 2012","fixed":[],"affected":"= r2","ecosystem":"vendor"},{"name":"microsoft windows server 2016","fixed":["10.0.14393.9612"],"affected":"< 10.0.14393.9612","ecosystem":"vendor"},{"name":"microsoft windows server 2019","fixed":["10.0.17763.9376"],"affected":"< 10.0.17763.9376","ecosystem":"vendor"},{"name":"microsoft windows server 2022","fixed":["10.0.20348.5761"],"affected":"< 10.0.20348.5761","ecosystem":"vendor"},{"name":"microsoft windows server 2025","fixed":["10.0.26100.33650"],"affected":"< 10.0.26100.33650","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["email-attachment","exploited","microsoft-windows-shell","motw","vendor","windows"],"not_affected_if":["patched-oct-2026","unknown"],"how_to_check":"Run winver or [System.Environment]::OSVersion and compare the build with the fixed builds. Win11 24H2: 10.0.26100.9711. Win11 26H1: 10.0.28000.3231. Win10 22H2: 10.0.19045.7807. Server 2025: 10.0.26100.33650. A build at or above these has the Oct 2026 update. Also run Get-HotFix for the KB listed on the MSRC page.","fix":"Install the Oct 13 2026 cumulative update for your Windows version, using the builds above. KB numbers are on the MSRC page. No workaround is stated in what I read. Until patched, treat files from email or the web with caution and watch for attachments and scripts that run without a MOTW warning.","status":"open","published_at":"2026-10-13T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:50+00:00","triaged_at":"2026-10-23T19:50:00+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"vendor","confidence":0.75,"triage":{"at":"2026-10-23T19:50:00Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft update for this CVE and follow CISA BOD 26-04 guidance; if no mitigation exists, discontinue use of the affected product or service as CISA directs.","summary":"A command injection flaw in the Windows Shell lets an unauthorized attacker over the network bypass a security feature. CISA lists it as actively exploited in the wild.","category":"vendor","who_cares":["windows","microsoft-windows-shell"],"confidence":0.6,"analyst_note":"Find the Microsoft Security Response Center advisory for CVE-2026-96951 to get affected Windows builds, the patch KB, and any workaround; the sources provided do not list versions.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"severity_if_unknown":"high"},"cost_usd":0.000361,"input_tokens":2198,"output_tokens":283,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft Security Response Center advisory for CVE-2026-96951 to get affected Windows builds, the patch KB, and any workaround; the sources provided do not list versions.","search":"'-04':200C,226C,257C '-2026':17A,20A '-77':111B '-96951':18A,21A '10':31A,41A,45A,49A,53A '11':25A,28A,57A,61A,65A,69A,73A '13':152B '1607':42A '1809':46A '2012':78A '2016':82A '2019':86A '2022':90A '2025':35A,94A '2026':153B '21h2':50A '22h2':32A,54A '23h2':58A '24h2':26A,62A '25h2':66A '26':199C,225C,256C '26h1':29A,70A '26h2':74A '8.8':143B 'accord':189C 'action':185C 'adher':253C 'allow':15A,171C 'appli':186C 'applic':223C 'asset':247C 'attach':97B 'attack':114B,174C 'base':204C 'bod':198C,224C,255C 'bypass':176C 'chat':134B 'cisa':157B,183C,196C,213C 'cloud':229C 'command':9A,10A,108B,167C 'complianc':194C 'contain':165C 'craft':127B 'cve':16A,19A 'cvss':142B 'cwe':110B 'deliv':131B 'detect':147B 'discontinu':232C 'download':137B 'element':5A 'email':96B,133B 'email-attach':95B 'ensur':193C,252C 'evad':115B 'evalu':245C 'exploit':98B,146B,161B 'exposur':250C 'featur':179C 'file':128B 'fix':148B 'follow':222C 'forens':215C 'guidanc':211C,227C 'guidelin':259C 'import':141B 'improp':1A 'inject':11A,109B,168C 'instruct':192C 'internet':249C 'let':112B 'link':130B 'list':158B 'mark':116B 'microsoft':22A,36A,39A,43A,47A,51A,55A,59A,63A,67A,71A,75A,79A,83A,87A,91A,100B,138B,162C 'microsoft-windows-shel':99B 'mitig':187C,238C 'motw':103B,120B 'must':124B 'network':182C 'neutral':2A 'note':210C,221C 'oct':151B 'open':125B 'outlook':37A 'patch':154B,258C 'priorit':201C 'product':236C 'protect':121B 'rate':139B 'report':145B 'requir':184C,217C 'respons':243C 'risk':206C 'secur':178C,202C 'see':207C,218C 'server':34A,77A,81A,85A,89A,93A 'servic':230C 'shell':14A,102B,107B,164C 'special':4A 'stakehold':241C 'triag':216C 'tuesday':155B 'unauthor':173C 'unavail':240C 'updat':156B,203C 'url':208C,219C 'use':6A,233C 'user':123B 'vendor':104B,191C 'vulner':169C 'web':38A,119B 'window':13A,101B,105B,106B,163C 'windows':23A,24A,27A,30A,33A,40A,44A,48A,52A,56A,60A,64A,68A,72A,76A,80A,84A,88A,92A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-13T00:00:00+00:00","kev":{"dateAdded":"2026-10-13","dueDate":"2026-10-16","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-96951","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-96951","severity":null,"published_at":"2026-10-13T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:50+00:00","fetched_at":"2026-10-25T17:39:54+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96951:106","url":null,"severity":null,"published_at":"2026-10-23T21:34:52+00:00","modified_at":"2026-10-23T21:34:52+00:00","first_seen_at":"2026-10-23T21:34:52+00:00","fetched_at":"2026-10-23T21:34:52+00:00","note":"Read MSRC page (released Oct 13 2026): Windows Shell MotW security feature bypass, CWE-77, CVSS 8.8, exploitation detected, not publicly disclosed. KB article numbers were cut off in the page text I got; the builds below are the ones I read. Server 2025 Server Core, Win11 26H1 and Win10 22H2 x64 rows were not seen. X posts were reposts, none saved."},{"source":"nvd","external_id":"CVE-2026-96951","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96951","severity":null,"published_at":"2026-10-13T19:22:07+00:00","modified_at":"2026-10-16T17:18:00+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[{"id":1114,"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951","title":"MSRC: Windows Shell Security Feature Bypass Vulnerability CVE-2026-96951","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}