CISA Adds CVE-2026-96951 in Windows Shell to Actively Exploited List
Microsoft released a fix for a Windows Shell vulnerability that attackers exploited before the update was disclosed. CISA subsequently added it to the Known Exploited Vulnerabilities catalog.
CVE-2026-96951 in Windows Shell is a vulnerability that the U.S. agency CISA added to the Known Exploited Vulnerabilities (KEV) catalog. Microsoft released a fix for the vulnerability on October 13, 2026, and also confirmed that it had been exploited before the security update was disclosed.
Microsoft materials identify the flaw as a Windows Shell Security Feature Bypass Vulnerability. The CVE record describes it as command injection in Windows Shell that could allow an unauthorized attacker to bypass a security feature over the network. The vulnerability has a CVSS score of 8.8 out of 10, rated High.
CVE-2026-96951 in the KEV Catalog
Being added to KEV means that CISA lists the vulnerability as actively exploited. The agency recommends deploying mitigations according to the vendor’s instructions. If mitigations are unavailable, its general recommendation for catalog entries is to stop using the product.
In this case, Microsoft’s updates are available. Windows endpoint and server administrators should therefore prioritize verifying the deployment of the October security updates and appropriately test them in the organization’s environment before broad deployment.
What Is Known About the Risk
According to the available description, the flaw could allow a security feature to be bypassed over the network. The risk affects systems running a vulnerable version of Windows and also depends on whether the user interacts with malicious content.
Public sources have not yet identified the attacker, a specific campaign, or the scope of confirmed compromises associated with this flaw. A complete technical exploitation procedure or specific indicators of compromise is also unavailable. Therefore, public information cannot reliably determine which protection mechanism attackers bypassed in individual cases beyond the general designation of security feature bypass.
Recommendations for Administrators
- Verify that Microsoft’s October security updates are deployed on managed devices.
- Search for suspicious files and activity related to Windows Shell according to internal monitoring procedures.
- Monitor further announcements from Microsoft, CISA, and trusted security researchers.
Further information may clarify the attack technique used, the attackers’ targets, and any indicators of compromise. Reports of known issues after the deployment of Windows’ October cumulative updates and any additions to the CISA KEV record will also be relevant.
Sources
- CISA Known Exploited Vulnerabilities Catalog – Confirms that CVE-2026-96951 was added to KEV and the recommended response according to the vendor’s instructions.
- Microsoft Japan Security Team – October 2026 Security Update – Microsoft confirms that CVE-2026-96951 was exploited before the update was released and that the fix was released on October 13, 2026.
- CVE Program – CVE-2026-96951 – The record from CNA Microsoft describes command injection in Windows Shell and lists a CVSS score of 8.8.
- Center for Internet Security – Critical Patches Issued for Microsoft Products – Independently corroborates that Microsoft identified CVE-2026-96951 as exploited in the wild.
Verified and updated: October 14, 2026 06:25
