THE U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a Microsoft Windows Shell flaw, tracked as CVE-2026-96951, to its Known Exploited Vulnerabilities (KEV) catalog. The advisory notes that the vulnerability is a Windows Shell command injection flaw with a CVSS score of 8.8, and that exploitation can bypass Mark of the Web (MOTW) protections. Microsoft confirms the flaw is being actively exploited.
An attacker could, via a crafted file delivered in email or instant message scenarios, coax a targeted user to take action, such as clicking a link or opening a malicious attachment, enabling remote code execution after bypassing security protections.
The agency emphasised that federal bodies are required to address KEV-listed vulnerabilities under Binding Directive 22-01, with a due date for remediation set to 16 October 2026. Private organisations are urged to review CISA’s KEV Catalog and apply fixes to their infrastructure.
In the same update, CISA additionally added an Ivanti Connect Secure FortiMail vulnerability, tracked as CVE-2026-104935 (CVSS 8.6), described as an authentication bypass caused by spoofing in ICS versions before 25.1.3[.]0, which could permit a remote, unauthenticated attacker to execute arbitrary commands. The advisory also clarifies that ICS versions 22.7R2.14 and earlier are not affected.