CVE-2026-96951 is a command injection vulnerability in the Windows Shell component that Microsoft flags as actively exploited. The vulnerability allows an unauthenticated attacker to bypass security mechanisms over the network. Microsoft rates the severity as 8.8 out of 10 under CVSS 3.1 (HIGH). The vulnerability has been added to the CISA Known Exploited Vulnerabilities catalog with a remediation deadline of 16 October 2026. It affects Windows 10, Windows 11, Windows Server from 2012 R2 through 2025, as well as Outlook.com. Organizations need to apply security updates immediately.
Technical details of the vulnerability
According to the CVE record, the vulnerability is classified as CWE-77 — improper neutralization of special elements used in a command. This means an attacker can inject arbitrary commands via the Windows Shell component, leading to a bypass of security features (Security Feature Bypass). The attack vector is network-based, the exploitation complexity is low, no privileges are required, but user interaction is necessary (CVSS vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Microsoft’s metadata indicates that the vulnerability was not publicly disclosed before the patch was released, but exploitation has already been observed, including against the latest software versions. The CVE record was published and updated on 13 October 2026.
Affected products and versions
The scope of the vulnerability goes beyond typical Windows Shell issues — it affects not only desktop and server operating systems, but also the Outlook.com cloud service. The full list of vulnerable configurations, according to the CVE record:
- Outlook.com — versions from 1.0.0 to 20260925.100
- Windows 10 Version 1607 (32-bit, x64) — from 10.0.14393.0 to 10.0.14393.9612
- Windows 10 Version 1809 — from 10.0.17763.0 to 10.0.17763.9376
- Windows 10 Version 21H2 — from 10.0.19044.0 to 10.0.19044.7807
- Windows 10 Version 22H2 — from 10.0.19045.0 to 10.0.19044.7807
- Windows 11 version 23H2 — from 10.0.22631.0 to 10.0.22631.7652
- Windows 11 Version 24H2 (ARM64, x64) — from 10.0.26100.0 to 10.0.26100.9711
- Windows 11 Version 25H2 (ARM64, x64) — from 10.0.26200.0 to 10.0.26200.9711
- Windows 11 version 26H1 — from 10.0.28000.0 to 10.0.28000.3231
- Windows 11 Version 26H2 — from 10.0.26300.0 to 10.0.26300.9711
- Windows Server 2012 R2 — from 6.3.9600.0 to 6.3.9600.23470
- Windows Server 2016 — from 10.0.14393.0 to 10.0.14393.9612
- Windows Server 2019 — from 10.0.17763.0 to 10.0.17763.9376
- Windows Server 2022 (x64) — from 10.0.20348.0 to 10.0.20348.5761
- Windows Server 2025 (x64) — from 10.0.26100.0 to 10.0.26100.33650
The presence of Outlook.com in the list of affected products means that when triaging an incident, you need to check not only Windows desktop and server deployments, but also cloud services. This expands the attack surface beyond traditional workstations.
What is unknown
At the time of publication, Microsoft does not disclose which threat groups or campaigns are behind the exploitation of the vulnerability. The available primary sources do not contain indicators of compromise (IOC), a description of the exploitation chain, or mapping to MITRE ATT&CK tactics. Information on the use of the vulnerability in ransomware campaigns is also absent from the current CISA KEV data.
Impact assessment
A combination of several factors makes this vulnerability a priority for immediate response. First, its active exploitation has been confirmed — Microsoft explicitly states the status “Exploited: Yes”. Second, the broad coverage: from legacy Windows Server 2012 R2 to the latest Windows 11 26H2 and Windows Server 2025, including the Outlook.com cloud service. Third, the low entry barrier for the attacker — no privileges are required, the attack is possible over the network, and the only condition is user interaction (for example, opening a malicious file or following a link).
The maximum impact on all three CIA parameters (confidentiality, integrity, availability) is rated as HIGH, which, if successfully exploited, can lead to full system compromise.
Recommendations
- Immediately install Microsoft security updates for all affected products. The remediation deadline in the CISA KEV catalog is 16 October 2026, which is only three days from the publication date.
- Inventory all Windows-based systems — workstations, servers, and cloud services — to identify vulnerable versions. Pay special attention to server deployments, which are often updated with a delay.
- Check the build versions of installed systems and compare them with the threshold values from the list of affected products. Systems with build numbers below the specified thresholds are vulnerable.
- For organizations subject to CISA BOD 22-01, remediation of the vulnerability is mandatory within the established timeframe.
We have previously covered other cases of active exploitation of vulnerabilities in Microsoft products — in particular, the privilege escalation vulnerability in AD FS, as well as the addition of SharePoint vulnerabilities to the CISA KEV catalog. The current case confirms a persistent trend: Windows components remain a priority target for attackers.
The three-day window until the CISA KEV deadline and the confirmed exploitation leave no room for postponing patching. The priority is the immediate update of all Windows systems and verification of Outlook.com builds up to the threshold version 20260925.100. The lack of public exploitation details does not reduce the risk — it only means that defenders cannot yet rely on signature-based detection and must focus on remediating the vulnerability as the only reliable protection measure.
