ZeroDayAlert

CVE-2026-96951: Microsoft Windows Command Injection Vulnerability

Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.

Microsoft Windows Added to KEV 2026-10-13 Federal due 2026-10-16 Known ransomware use

Required action — quoted from CISA

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Where this comes from. The identifier, product, dates and required action above are copied verbatim from the CISA Known Exploited Vulnerabilities catalog. The action plan below is written by an AI agent from that record and published automatically. AssurePort has not independently tested this vulnerability and makes no claim about whether any specific system is affected.

Who is affected

This record identifies a command injection vulnerability in Microsoft Windows Shell that allows an attacker to bypass a security feature over a network. The record does not specify which versions of Windows are affected, the nature of the bypassed security feature, or the network conditions required for exploitation. You are affected if you operate Windows systems exposed to untrusted network input.

How to check whether this touches you

  • Inventory all Windows systems in your environment, noting OS version and Shell configuration.
  • Determine whether each system accepts network input that reaches Windows Shell (remote sessions, service interfaces, web application backends, or any network-facing process that invokes shell commands).
  • Check the Microsoft security advisory for CVE-2026-96951 to identify the affected version range; cross-reference your inventory against it.
  • Query process logs and network access controls to identify which systems have received inbound connections that could trigger Shell processing.
  • If Shell processing is performed on behalf of external users or systems, assume exposure unless the record specifies an additional condition you can verify.

What to do

  1. Consult Microsoft's advisory for CVE-2026-96951 and confirm the affected versions and the availability of patches.
  2. If a patch is available and tested in your environment, schedule deployment according to CISA BOD 26-04 guidance (federal systems: by 2026-10-16; others: risk-based).
  3. Until patching is complete, disable or restrict network-facing functions that invoke Shell commands, and enable network segmentation to limit inbound access to affected systems.
  4. Configure logging on affected systems to record all process creation, command-line arguments, and network connections to Windows Shell handlers.
  5. If you operate the product as a cloud service and no mitigation is available, follow BOD 26-04 guidance on service discontinuation or isolation.

If you find you were exposed

Exploitation typically occurs before disclosure becomes public. Review process creation logs, shell history, and network connection logs from at least 90 days before the CVE publication date (2026-10-13) to hunt for suspicious command sequences or unexpected network access. Examine authentication logs for any lateral movement or privilege escalation. Log retention policies are often the limiting factor; prioritise recovery of logs from systems that accept network input and from any system that shows signs of compromise.

Get these the morning they land.

One email, only when a vulnerability is newly confirmed as exploited — the CISA record plus our action plan. No more than one a day, and nothing on quiet days.

Knowing it exists is not the same as knowing you are exposed.

This page can tell you that CVE-2026-96951 is being exploited. It cannot tell you whether Windows is running somewhere of yours that is reachable. That question is what a scan answers.

Check your own surface →