CVE-2026-96951: Windows Shell command injection exploited in the wild (October 2026 Patch Tuesday)
Published 27/10/2026 11:00
Timeline
3 events over 14 d
- 13/10/2026ConfirmedCISA Known Exploited Vulnerabilities+0 min
- 13/10/2026ExploitedCISA Known Exploited Vulnerabilities+14 d
- 27/10/2026 11:00Published on WatchtowerPro CISO
In short
CVE-2026-96951 is a command injection flaw in Windows Shell that lets an unauthorized attacker bypass a security feature over a network. Microsoft and CISA list it as exploited in the wild. The fix is in the October 2026 Patch Tuesday updates, so install them quickly.
How bad is it
Serious: it is exploited in the wild, and an unauthorized attacker can bypass a security feature, apparently Mark of the Web, over a network.
Being exploited - on CISA's known-exploited list.
Severity score
CVSS 3.1 from NVD, from microsoft.com, read 27/10/2026.
What an attacker needs
- Internet access to itEnough
- A loginNot needed
- A user to clickYes
- Special settingsNo
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Run their own code on the system
- Read the data it holds
- Change or delete that data
- Take it offline
Type: remote code execution.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- Windows 10 and 11 and "some Server versions", according to Krebs on Security. The full list of affected builds is not confirmed.
- A third-party documentation project gives the range as Windows 10 1607 to Windows 11 26H2. This is not confirmed.
- A feed-bot alert lists Windows 10 1607 and 1809. The product list is unconfirmed.
What to do now
- Install the October 2026 cumulative update on all Windows systems as soon as possible, starting with systems where users open files. Confirmed fixed builds so far: Windows 10 22H2 10.0.19045.7807 and Windows Server 2022 10.0.20348.5761. Fixed builds for other branches are not yet known, so check Microsoft's advisory for them.
- No vendor workaround or interim measure has been found in the sources. Check Microsoft's advisory for one. Any interim measure would only reduce exposure and would not make a system safe.
- CISA requires forensic triage, so check systems for signs of compromise from before the patch.
- Make sure your vulnerability scanner can see this flaw. Wazuh 4.14.8 and 4.14.9 reportedly miss the October 2026 Windows CVEs, including this one.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 6 open questions, followed up as sources answer and all 5 sources with their dates. And technology matching: which of your systems run Microsoft Windows Shell, at which version, fixed or not - and what each one needs.
Main sources
Known exploited: Microsoft Windows - Microsoft Windows Command Injection Vulnerability Vendor · CVE-2026-96951 Windows Shell Security Feature Bypass Vulnerability Vendor · Patch Tuesday - October 2026 Research