home / blog
2026-10-13 · high
Windows Shell: command injection and security bypass (CVE-2026-96951)
Command injection in Windows Shell that bypasses a security feature, listed in CISA KEV. Microsoft patch from October 2026.
On 13 October 2026 Microsoft published the record for CVE-2026-96951, a command injection in Windows Shell that lets an unauthenticated network attacker bypass a security feature. The CVSS v3.1 score is 8.8.
The flaw is listed in CISA's KEV catalogue, the list of vulnerabilities with evidence of active exploitation. For this reason the patch should be treated as urgent, not as part of the normal monthly cycle.
Install the October 2026 patch on all affected Windows versions, checking the Microsoft bulletin for the exact list of builds. Where the patch cannot be applied at once, restrict network access to exposed Windows machines.
At a glance
- What
- Command injection in Windows Shell that lets an unauthenticated network attacker bypass a security feature.
- Severity
- CVSS v3.1 8.8 (high), according to the Microsoft record on NVD.
- Cause
- Insufficient neutralisation of special characters in a command (CWE-77).
- Status
- Listed in the CISA KEV catalogue, so reported as actively exploited.
- Action
- Install the Microsoft October 2026 patch on all affected Windows versions, checking the list in the bulletin.
Sources: Microsoft MSRC, CVE-2026-96951 · CISA, catalogo KEV