CVE-2026-96951
published 2026-10-13CVE-2026-96951: Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security…
PriorityP187high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
KEVITW
CISA Known Exploited Vulnerabilitydue 2026-10-16
Exploited in the wild
EPSS
1.51%
74.2th percentile
Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
Affected
29 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | outlook.com | >= 1.0.0 < 20260925.100 | 20260925.100 |
| microsoft | windows_10_1607 | < 10.0.14393.9612 | 10.0.14393.9612 |
| microsoft | windows_10_1809 | < 10.0.17763.9376 | 10.0.17763.9376 |
| microsoft | windows_10_21h2 | < 10.0.19044.7807 | 10.0.19044.7807 |
| microsoft | windows_10_22h2 | < 10.0.19045.7807 | 10.0.19045.7807 |
| microsoft | windows_10_version_1607 | >= 10.0.14393.0 < 10.0.14393.9612 | 10.0.14393.9612 |
| microsoft | windows_10_version_1809 | >= 10.0.17763.0 < 10.0.17763.9376 | 10.0.17763.9376 |
| microsoft | windows_10_version_21h2 | >= 10.0.19044.0 < 10.0.19044.7807 | 10.0.19044.7807 |
| microsoft | windows_10_version_22h2 | >= 10.0.19045.0 < 10.0.19045.7807 | 10.0.19045.7807 |
| microsoft | windows_11_23h2 | < 10.0.22631.7652 | 10.0.22631.7652 |
| microsoft | windows_11_24h2 | < 10.0.26100.9711 | 10.0.26100.9711 |
| microsoft | windows_11_25h2 | < 10.0.26200.9711 | 10.0.26200.9711 |
| microsoft | windows_11_26h1 | < 10.0.28000.3231 | 10.0.28000.3231 |
| microsoft | windows_11_26h2 | < 10.0.26300.9711 | 10.0.26300.9711 |
| microsoft | windows_11_version_23h2 | >= 10.0.22631.0 < 10.0.22631.7652 | 10.0.22631.7652 |
| microsoft | windows_11_version_24h2 | >= 10.0.26100.0 < 10.0.26100.9711 | 10.0.26100.9711 |
| microsoft | windows_11_version_25h2 | >= 10.0.26200.0 < 10.0.26200.9711 | 10.0.26200.9711 |
| microsoft | windows_11_version_26h1 | >= 10.0.28000.0 < 10.0.28000.3231 | 10.0.28000.3231 |
| microsoft | windows_11_version_26h2 | >= 10.0.26300.0 < 10.0.26300.9711 | 10.0.26300.9711 |
| microsoft | windows_server_2012 | — | — |
| microsoft | windows_server_2012_r2 | >= 6.3.9600.0 < 6.3.9600.23470 | 6.3.9600.23470 |
| microsoft | windows_server_2016 | < 10.0.14393.9612 | 10.0.14393.9612 |
| microsoft | windows_server_2016 | >= 10.0.14393.0 < 10.0.14393.9612 | 10.0.14393.9612 |
| microsoft | windows_server_2019 | < 10.0.17763.9376 | 10.0.17763.9376 |
| microsoft | windows_server_2019 | >= 10.0.17763.0 < 10.0.17763.9376 | 10.0.17763.9376 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vulncheck8.8HIGH
cisa8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Microsoft Windows Command Injection Vulnerability
cisa·2026-10-13·CVSS 8.8
CVE-2026-96951 [HIGH] CWE-77 Microsoft Windows Command Injection Vulnerability
Vulnerability: Microsoft Windows Command Injection Vulnerability
Affected: Microsoft Windows
Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes: https://msrc.microsoft.com/update-guide/en
GHSA
Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
ghsa_unreviewed·2026-10-13
CVE-2026-96951 [HIGH] CWE-77 Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
VulnCheck
Microsoft Windows Command Injection Vulnerability
vulncheck·2026·CVSS 8.8
CVE-2026-96951 [HIGH] CWE-77 Microsoft Windows Command Injection Vulnerability
Microsoft Windows Command Injection Vulnerability
Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.
Affected: Microsoft Windows
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Exploitation References: https://api.msrc.microsoft.com/cvrf/v3
No detection rules found.
No public exploits indexed.
Tenable
Oracle October 2026 Critical Patch Update Addresses 1209 CVEs
blogs_tenable·2026-10-20
CVE-2026-96951 Oracle October 2026 Critical Patch Update Addresses 1209 CVEs
## Oracle October 2026 Critical Patch Update Addresses 1209 CVEs
Oracle addresses 1209 CVEs in its final quarterly update of 2026 with 1295 patches, including 112 critical updates.
## Key Takeaways
The October 2026 Critical Patch Update (CPU) contains fixes for 1209 unique CVEs in 1295 security updates
112 issues (8.6% of all patches) were assigned a critical severity rating
Oracle Fusion Middleware received the highest number of patches at 206, accounting for 15.9% of all patches
## Background
On October 20, Oracle released its Critical Patch Update (CPU) for October 2026 , the final quarterly update of the year. This CPU contains fixes for 1209 unique CVEs in 1295 security updates across 33 Oracle product families. Out of the 1295 security updates published this quarter, 8.6% of p
Hackernews
⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More
blogs_hackernews·2026-10-19
CVE-2026-102764 ⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More
The worst problems don't always come with a warning. Sometimes they arrive through a service everyone trusts, a device someone bought, or a system nobody thought to check. By the time something looks wrong, the damage may already be done.
This week had plenty of that. Trusted connections became a problem. Hardware wasn't as safe as it looked. Old bugs found new victims, and some systems were left so exposed that breaking in barely required any effort. Even AI agents crossed lines they weren't supposed to.
Some attacks were cleve
Checkpoint
19th October – Threat Intelligence Report
blogs_checkpoint·2026-10-19·CVSS 8.8
CVE-2026-35029 [HIGH] 19th October – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 19th October – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 19th October, please download our Threat Intelligence Bulletin.
TOP ATTACKS AND BREACHES
CenterPoint Energy, a US utility company serving Texas and several other states, has disclosed a data breach affecting more than 1 million Texas residents. Unauthorized access to an external system exposed names, addresses, Social Security information, and driver’s license numbers, according to regulatory notifications filed by the company.
Hackernews
Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug
blogs_hackernews·2026-10-14·CVSS 8.8
CVE-2026-96951 [HIGH] Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug
Microsoft on Tuesday shattered its own Patch Tuesday record by shipping patches for a whopping 1,413 vulnerabilities , including one that it said has come under active exploitation.
These include 1,102 flaws in Windows, 134 in Office, 61 in Developer Tools, 36 in SharePoint Server, and 22 in SQL Server. Of these, more than 670 relate to privilege escalation, followed by over 300 remote code execution flaws and 250 information disclosure flaws. Over 70 flaws are rated Critical in severity.
"Hundreds of CVEs in a single release used to be the exceptio
Sans Isc
October 2026 Microsoft Patch Tuesday, (Tue, Oct 13th)
blogs_sans_isc·2026-10-13·CVSS 8.8
CVE-2026-96951 [HIGH] October 2026 Microsoft Patch Tuesday, (Tue, Oct 13th)
October 2026 Microsoft Patch Tuesday
Published: 2026-10-13. Last Updated: 2026-10-13 19:25:52 UTC
by Johannes Ullrich (Version: 1)
0 comment(s)
Microsoft today released patches for 1,417 vulnerabilities. 76 of these vulnerabilities are rated critical, with 7 critical vulnerabiilties requiring no customer actions. One vulnerability was disclosed before today's patch Tuesday, and one is already exploited.
CVE-2026-96951: An already exploited Windows Shell Security Feature Bypass Vulnerability. This vulnerabliity allows bypassing the "Mark of the Web" making it easier to exeucte code by sending a malicious message to a user via e-mail or instant messaging. The victim will still have to open the file.
CVE-2026-108398: This vulnerability, a .NET framework security feature bypass, could be
Krebs
Microsoft Patches More Than 1,400 Security Flaws
blogs_krebs·2026-10-13·CVSS 8.8
CVE-2026-96951 [HIGH] Microsoft Patches More Than 1,400 Security Flaws
Microsoft today issued updates to fix more than 1,400 security vulnerabilities in its Windows operating systems and other software. Today’s epic patch batch dwarfs September’s record of nearly 1,000 fixes, which was already about ten times the normal monthly patch load from Redmond.
Just one of the weaknesses patched this week is considered a “zero day,” or already exploited in the wild. CVE-2026-96951 is a security feature bypass in the Windows Shell that affects Windows 10 and 11 systems, as well as some Server versions.
Windows 10 users might be wondering if they can still expect security updates after this month. Microsoft had been slated to stop shipping updates for Windows 10 systems in October 2025, but ended up adding another year of free updates after considerable pushback. A fe
Qualys
Microsoft Patch Tuesday, October 2026 Security Update Review
blogs_qualys·2026-10-13
CVE-2026-96951 Microsoft Patch Tuesday, October 2026 Security Update Review
## Table of Contents
Adobe Patch for October 2026
Zero-day Vulnerabilities Patched in September Patch Tuesday Edition
Critical Severity Vulnerabilities Patched in September Patch Tuesday Edition
Other Microsoft Vulnerability Highlights
Microsoft Release Summary
Discover and Prioritize Vulnerabilities inVulnerability Management, Detection & Response (VMDR)
Rapid Response withTruRisk Eliminate
Qualys Monthly Webinar Series
Microsoft has released its October 2026 Patch Tuesday security updates, addressing vulnerabilities across its products and services. As organizations continue to navigate an evolving threat landscape, applying security patches promptly remains critical to reducing exposure and strengthening security posture. This month’s updates highlight the importance of identif
Tenable
Microsoft’s October 2026 Patch Tuesday addresses 1407 CVEs (CVE-2026-96951)
blogs_tenable·2026-10-13·CVSS 8.8
CVE-2026-96951 [HIGH] Microsoft’s October 2026 Patch Tuesday addresses 1407 CVEs (CVE-2026-96951)
## Microsoft’s October 2026 Patch Tuesday addresses 1407 CVEs (CVE-2026-96951)
69 Critical
1337 Important
0 Moderate
1 Low
Microsoft addresses 1407 CVEs in the tenth Patch Tuesday of 2026, marking the second consecutive month to reset the bar as the largest Patch Tuesday release. This month’s updates include patches for two zero days, including one that was exploited in the wild.
Microsoft patched 1,407 CVEs in its October 2026 Patch Tuesday release, with 69 rated critical, 1,337 rated as important, and one rated as low.
This month’s update includes patches for 301 products and components. The following table lists the products with the most CVEs patched this month. A full list of patched products is available in the appendix.
1
Microsoft Office Excel
69
2
Role: DNS Server
52
Rapid7
Patch Tuesday - October 2026
blogs_rapid7·2026-10-13·CVSS 8.8
CVE-2026-96951 [HIGH] Patch Tuesday - October 2026
Microsoft is publishing 1,413 own-product vulnerabilities on October 2026 Patch Tuesday , including 1,102 vulnerabilities in Windows. Anyone who enjoyed last month’s record-setting Patch Tuesday will love the October 2026 edition, because it’s much bigger still. As Rapid7 has noted over the course of 2026, there is every reason to suppose that vulnerability volumes will continue to rise. Microsoft is aware of exploitation in the wild for just one of the vulnerabilities published today, as well as public disclosure for two others.
## Windows Shell: zero-day security feature bypass
The Windows Shell is Microsoft’s term for the GUI interaction logic for the entire OS provided by explorer.exe and associated libraries and APIs, and for the second time this year , the Windows Shell is the site
Tenable
Critical infrastructure orgs face heightened cyber risk from nation-state groups, AI threats
blogs_tenable·2026-10-13
CVE-2026-96951 Critical infrastructure orgs face heightened cyber risk from nation-state groups, AI threats
## Critical infrastructure orgs face heightened cyber risk from nation-state groups, AI threats
Critical infrastructure faces mounting threats from nation-state groups and AI-driven attacks. In the latest installment of our Cybersecurity Awareness Month blog series, learn how leading cybersecurity agencies, such as CISA, are advising critical infrastructure organizations on ways to protect themselves and the essential services they provide.
## Key takeaways
Critical infrastructure organizations often struggle with asset visibility gaps that create hidden attack vectors. Many older OT systems are difficult to inventory, leaving them unmonitored and unpatched.
Attackers are leveraging AI to map converged IT/OT networks at machine speed and exploit uninventoried legacy systems. Attackers
Talos
Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities
blogs_talos·2026-10-13·CVSS 9.8
CVE-2026-96951 [CRITICAL] Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities
## Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities
Microsoft has released its monthly security update for October 2026, which includes 1415 vulnerabilities affecting a range of products, including 85 that Microsoft marked as "critical."
Microsoft notes that 1 of the vulnerabilities disclosed this month have been exploited in the wild
CVE-2026-96951 is a security feature bypass vulnerability that affects Windows Shell. The shared weakness is Improper Neutralization of Special Elements used in a Command ('Command Injection'). The vulnerability has a CVSS base score of 8.8.
Out of 85 "critical" vulnerabilities, 67 are remote code execution (RCE) vulnerabilities.
Microsoft considers exploitation of the following vulnerabilities more likely.
CVE-2026-7
Crowdstrike
October 2026 Patch Tuesday: 1,413 CVEs Include Three Zero-Days and 75 Critical Vulnerabilities
blogs_crowdstrike
CVE-2026-100219 October 2026 Patch Tuesday: 1,413 CVEs Include Three Zero-Days and 75 Critical Vulnerabilities
U.S. Government Disrupts FAMOUS CHOLLIMA Operation with CrowdStrike Assistance Oct 13, 2026
October 2026 Patch Tuesday: 1,413 CVEs Include Three Zero-Days and 75 Critical Vulnerabilities Oct 13, 2026
Solving the Continuous Authorization Conundrum Oct 08, 2026
CrowdStrike and Anthropic Give Critical Infrastructure Defenders the AI Advantage Oct 08, 2026
U.S. Government Disrupts FAMOUS CHOLLIMA Operation with CrowdStrike Assistance Oct 13, 2026
October 2026 Patch Tuesday: 1,413 CVEs Include Three Zero-Days and 75 Critical Vulnerabilities Oct 13, 2026
Solving the Continuous Authorization Conundrum Oct 08, 2026
CrowdStrike and Anthropic Give Critical Infrastructure Defenders the AI Advantage Oct 08, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Hel
2026-10-13
Published
2026-10-13
Added to CISA KEV
Exploited in the wild