CVE-2026-96951: Microsoft Windows Command Injection Vulnerability

Microsoft's Security Update Guide says command injection in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.[2] Microsoft rates the flaw "Important"[2], with a CVSS base score of 8.8.According to Microsoft, an attacker who successfully exploited the vulnerability could evade Mark of the Web (MOTW) defenses.[2] The advisory says an attacker would have to convince a user to take action, for example by enticing them to click a link or open a malicious attachment.[2]HOL Guard reports that Microsoft fixed CVE-2026-96951 in the October 2026 Patch Tuesday release (2026-10-13)[3]. It also reports that Microsoft marks it Exploitation Detected and not publicly disclosed.[3]CISA announced it had added the bug to its Known Exploited Vulnerabilities catalog as a "Microsoft Windows Command Injection Vulnerability"[4]. Strix reports that federal agencies must remediate by Oct 16, 2026.[5]HOL Guard lists the affected systems as Windows 10 1607/1809/21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 R2, 2016, 2019, 2022 and 2025.[3]CyberInsider reports that the patch came in a Patch Tuesday release that fixes 1,413 Windows vulnerabilities[6]. WindowsForum, however, notes that SANS reported that Microsoft today released patches for 1,417 vulnerabilities.[7]WindowsForum advises admins to deploy the October cumulative updates "starting with machines used for email and web browsing."[7]