CVE-2026-96951

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-96951 8.8

Microsoft · Windows · Added 2026-10-13 · Published 2026-10-13

3-Day Required KEV Active Exploitation

Details

VulnerabilityMicrosoft Windows Command Injection Vulnerability

VendorMicrosoft

ProductWindows

Date added2026-10-13

Due date2026-10-16

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-77

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Descriptions

KEV: Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.

NVD: Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.

Compliance SSVC + BOD 26-04

Automatableno

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline14 days

Forensic (public)Required

Forensic (non-public)Not required

Research metadata

Last researched2026-10-13 19:53 UTC

Wall time0.8s

Searches22

Component defaultyes - Windows Shell is the default shell on every affected Windows version; Microsoft documentation confirms MOTW Zone.Identifier marking is default behavior for internet-downloaded files (ZoneId=3, blocked by default per the Unblock-File documentation)

Sources https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951
https://api.msrc.microsoft.com/cvrf/v2.0/cvrf/2026-Oct
https://nvd.nist.gov/vuln/detail/CVE-2026-96951
https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/96xxx/CVE-2026-96951.json
https://support.microsoft.com/en-us/servicing/os/windows-11/2026/10/kb5127648-windows-11-24h2-25h2-26h2-security-update
https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/unblock-file

Hunting hypothesis agent

Hunt SmartScreen/Attachment Manager and Sysmon logs for Windows Shell executing an email- or IM-delivered file whose Zone.Identifier MOTW mark is missing or stripped - the command-injection MOTW bypass needs only a user click.

Research details

ComponentWindows Shell Mark of the Web (MOTW) handling when opening email- or IM-delivered files

PreconditionsNetwork-reachable delivery of a specially crafted file that the victim must open (email or instant message; CVSS UI:R); no authentication or privileges required (PR:N, AC:L). Affected versions: Windows 10 1607/1809/21H2/22H2, Windows 11 23H2 through 26H2, Windows Server 2012 R2 through 2025 below the October 2026 fixes (e.g. build 10.0.26100 below 10.0.26100.9711), and Outlook.com service builds below 20260925.100. agent

DeliverySpecially crafted file sent to the victim via email or instant message; opening it triggers Windows Shell command injection that evades MOTW (Outlook.com service builds below 20260925.100 also affected)

Public PoCno

Advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951

Exploit notesNo public PoC found: GitHub repository/issue/code search, Metasploit module metadata, Nuclei templates and Exploit-DB all returned nothing as of 2026-10-13. Exploitation is network-delivered (AV:N, AC:L) but requires the victim to open the crafted file (UI:R) and no privileges (PR:N); the MSRC FAQ confirms an email/instant-message lure and that the attacker cannot force the user to view the content. CISA lists the CVE in KEV with forensic triage required, indicating known exploitation, but no public technical write-up of the in-the-wild activity exists yet.

SummaryCVE-2026-96951 is a command-injection security feature bypass (CWE-77, CVSS 3.1 base 8.8) in Microsoft Windows Shell that lets a remote attacker evade Mark of the Web (MOTW) defenses. An attacker lures a victim into opening a specially crafted file via email or instant message; no privileges are required but user interaction is mandatory. Microsoft shipped fixes in the October 13, 2026 security updates (for example KB5127648, fixed build 10.0.26100.9711), and CISA added the CVE to KEV the same day with a 2026-10-16 due date; no public exploit or PoC was found in this research cycle.

Tia coverage

First reported2026-10-13

First exploit report2026-10-13

Exploit report → KEV0 days before the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

microsoft-october-2026-patch-tuesday-fixes-1-411-flaws-3-zero-da

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.