Vulnerability intelligence

CVE-2026-96951

Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.

CVSS Score

8.8

High

EPSS — Exploit Probability

—

Awaiting FIRST.org data · checked 2026-10-13

Exploitation

Confirmed in the wild

KEV since 2026-10-13

Remediation

Patch available

Federal deadline 2026-10-16

NVD entry Vendor patch PoC / advisory CISA KEV

1 article across 1 outlet · first covered Oct 13, 2026 · latest Oct 13, 2026

Coverage timeline

Adobe and Microsoft Patch Thousands of Flaws in Record Update
www.thezdi.com · Oct 13, 2026

Related CVEs — Microsoft

CVE-2026-102866 CVE-2026-65674 CVE-2026-96940 CVE-2026-32201KEV CVE-2026-45659KEV CVE-2026-56164KEV CVE-2026-50522KEV CVE-2026-55040KEV