AX·NEWS
Sign in

Vulnerability

CVE-2026-96951 — Microsoft Windows Command Injection Vulnerability

high 8.8 Exploited in the wild 5 stories · 5 outlets

Official record (cve.org)NVDCVE watch

Impacted if

  • Outlook WEB all versions
  • and 14 other products

Command injection · over the network · no login · a user must act

Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.

CISA Known Exploited Vulnerabilities

Added on 2026-10-13, federal remediation due 2026-10-16. Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

First seen by AX-NEWS · latest story . Severity: NVD, or the CVE record while the NVD has not scored it. This product uses data from the NVD API but is not endorsed or certified by the NVD.

Coverage

  1. Microsoft drops an actively exploited zero-day among record high of 1,413 vulnerabilities
    USCyberScoop Asia Cybersecurity

    Microsoft’s streak of record-breaking vulnerability disclosures continued with a mega Patch Tuesday , containing 1,413 defects affecting the company’s various enterprise products and services. The monthly batch of patches surpassed the…

  2. Update Windows: Record Patch Tuesday fixes flaw already under attack
    USMalwarebytes Labs Cybersecurity

    Microsoft’s October Patch Tuesday release addresses a record-breaking 1,413 vulnerabilities , including an actively exploited Windows Shell zero-day and two other publicly disclosed flaws. Just when you thought a previous record would…

  3. Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day
    USSecurityWeek Cybersecurity

    The most important is CVE-2026-96951, a security feature bypass flaw in Windows that has been exploited in the wild. The post Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day appeared first on…

  4. Breaking the Tuesday record of patches: October Microsoft Win11/Win10 updates repaired 1411 loopholes
    CNIT Home (EN Mirror) Hardware Translated from zh-cn
  5. Microsoft Patches More Than 1,400 Security Flaws
    USKrebs on Security Cybersecurity

    Microsoft today issued updates to fix more than 1,400 security vulnerabilities in its Windows operating systems and other software. Today’s epic patch batch dwarfs September’s record of nearly 1,000 fixes, which was already about ten times…