Windows Shell Command Injection Added To CISA KEV (CVE-2026-96951)

At a glance

Severity	CRITICAL
CVSS	CVE-2026-96951: 8.8
In CISA KEV (exploited)	Yes, due 2026-10-16
Vendor	Microsoft
CVE IDs	CVE-2026-96951

CISA has added a Windows Shell vulnerability, CVE-2026-96951, to its Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild is confirmed. The entry was added on 2026-10-13 and has a remediation due date of 2026-10-16, just three days later, so this Windows Shell vulnerability belongs at the front of the queue. The details come from the CISA KEV entry and the NVD record.

What happened

CISA lists the flaw as “Microsoft Windows Command Injection Vulnerability”. NVD describes it as improper neutralization of special elements used in a command (command injection) in Windows Shell. In plain terms, input that the shell passes into a command is not cleaned properly, so an attacker can influence what gets run.

The stated impact is that an unauthorized attacker can bypass a security feature over a network. NVD published the record on 2026-10-13, the same day CISA added it to KEV.

Which security feature is bypassed, who is exploiting the flaw and how widely have not been disclosed in the material we reviewed.

Am I affected?

If you run Microsoft Windows, treat yourself as potentially affected until you have checked Microsoft’s advisory. The NVD record does not list affected versions, and the KEV entry names only the product, Microsoft Windows.

Vendor and product: Microsoft, Windows (Windows Shell component).
Affected versions and builds: not disclosed in the NVD record. Check the Microsoft Security Response Center entry for the exact list.
Fixed builds: not stated in the data we have. Use the vendor guidance.

Technical details

CVE: CVE-2026-96951
Weakness: CWE-77, command injection.
CVSS: 8.8 (High), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Reading the vector: it is exploitable over the network (AV:N), with low complexity (AC:L), no privileges (PR:N) and user interaction required (UI:R). Confidentiality, integrity and availability impact are all rated high.
KEV status: added 2026-10-13, due date 2026-10-16.
Known ransomware campaign use: listed as Unknown by CISA.
EPSS: no score was available to us.

Note the wording: the description says “bypass a security feature”, while the vector rates confidentiality, integrity and availability impact as high. The sources do not reconcile the two, so do not assume the impact is limited to a single bypass.

Why this matters

This section is our analysis, not new facts from the sources.

Three things push this one up the list. It is confirmed exploited, it is reachable over the network without privileges, and Windows Shell is present on essentially every Windows endpoint and server. The user-interaction requirement means an attacker likely needs someone to open or click something, which fits phishing and web delivery, but that is an inference from the vector and not a stated attack chain.

The very short KEV deadline signals that CISA expects fast action. Even if you are not a US federal agency, the KEV listing is a strong signal to treat this as an emergency change rather than waiting for the next monthly cycle.

How to fix CVE-2026-96951

Check Microsoft’s advisory today. Open the MSRC entry for CVE-2026-96951 and identify the update or mitigation for each Windows version you run.
Patch within hours where you can. For internet-facing and high-exposure systems, and for users who handle external email and links, deploy first. Stage the rest straight after.
Apply vendor mitigations if no fix is available for a system. CISA’s required action says to follow vendor instructions and to discontinue use of the product if mitigations are unavailable.
Assess exposure. CISA tells stakeholders to evaluate each asset’s internet exposure and follow its current binding operational directive on prioritizing updates by risk.
Meet the date if you are covered by it. Federal agencies have until 2026-10-16.

Hunting and detection ideas

No indicators of compromise have been published in the sources we used, so there is nothing to block by hash or domain yet. These ideas follow from the nature of the flaw and are suggestions, not confirmed attacker behaviour:

Look for unusual child processes spawned by the Windows shell or by applications that hand content to it, especially command interpreters launched shortly after a user opens a file or link.
Review endpoint logs for command lines containing unexpected shell metacharacters or chained commands.
Check for new persistence, new accounts or outbound connections from machines that handled suspicious content in recent days.
CISA’s required action references forensics triage requirements. If you find signs of compromise, preserve evidence before you reimage.

What to do

Confirm exposure, patch or mitigate on the KEV timeline, hunt for follow-on activity, and tell help desk and security awareness teams to be wary of unexpected files and links until patching is complete. Re-check the CISA and Microsoft entries for updates, because exploitation details and affected builds may be added later.

Related coverage

Sources

Spotted an error or outdated detail? Email contact@cyberstrikenews.com with the article link. We correct and note every change. Read our Editorial Policy.