CISA added CVE-2026-96951 to its Known Exploited Vulnerabilities (KEV) catalogue on 13 October 2026. The vulnerability affects Microsoft Windows and is a command injection flaw in Windows Shell that allows an unauthorised attacker to bypass a security feature over a network.
CVE-2026-96951 is rated HIGH, with a CVSS score of 8.8. The available description identifies command injection as the vulnerability type and security-feature bypass as its impact; it does not provide further technical details about the affected feature or the steps required to exploit it. The attack vector is network-based. Microsoft has made a patch available, with vendor guidance published in its security update guide.
KEV inclusion indicates that active exploitation has been confirmed. The entry does not confirm use in ransomware campaigns; that status is listed as unknown. CISA set 16 October 2026 as the remediation deadline. Organisations should treat the short deadline as a prompt to identify affected Windows assets and apply the available update in line with vendor instructions and applicable requirements.
CISA requires agencies to “apply mitigations in accordance with vendor instructions”, ensuring compliance with BOD 26-04 guidance on prioritising security updates based on risk and with CISA’s Forensics Triage Requirements. For cloud services, agencies should follow applicable BOD 26-04 guidance; if mitigations are unavailable, they should discontinue use of the product. Stakeholders must evaluate each asset’s internet exposure and comply with BOD 26-04 patching guidelines.
The requirement directly applies to Federal Civilian Executive Branch (FCEB) agencies. All organisations should review their exposure and assess whether affected Windows systems require remediation.
For full details, consult the [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-96951) and CISA KEV catalogue.