Windows Shell CVE-2026-96951: command injection exploited

📌 Later developments: October 2026 Patch Tuesday: over 1,400 flaws and priorities (October 13, 2026)

On 13 October 2026 CISA added CVE-2026-96951 to its Known Exploited Vulnerabilities (KEV) catalog. It is a command injection vulnerability in Windows Shell, the Microsoft Windows component that handles the graphical interface and the opening of files and shortcuts. Microsoft published the entry the same day, the second Tuesday of the month, when the monthly Windows updates are released. Microsoft rates it high: CVSS 3.1 8.8.

Inclusion in the KEV catalog means CISA has evidence of active exploitation. The deadline set for US federal agencies is 16 October 2026: three days.

What happened

CISA added the vulnerability to the KEV catalog as “Microsoft Windows Command Injection Vulnerability”. The catalog lists its use in ransomware campaigns as “unknown”. The advisory asks organisations to apply mitigations according to the vendor’s instructions, in line with Binding Operational Directive BOD 26-04 on prioritising security updates based on risk and with CISA’s forensic triage requirements; for cloud services the same directive applies, and if no mitigations are available the product should be discontinued. It also asks organisations to assess the internet exposure of every asset.

On the same day the NCSC-NL, the Dutch national cyber security centre, published advisory NCSC-2026-0423 on vulnerabilities fixed in Microsoft Windows, rated M/H (medium likelihood, high impact). The text of the Dutch advisory was not available at the time of writing: we cannot say whether or how it covers CVE-2026-96951, nor how many vulnerabilities it lists.

The sources give no details on the attacks observed, the attackers or the victims.

Technical details

• CVE: CVE-2026-96951, published on 13 October 2026. At the time of writing the NVD entry is “undergoing analysis”: NIST has not yet published its own assessment.
• Product: Microsoft Windows, Windows Shell component. The available sources do not list the affected Windows versions or the fixing updates: these are in Microsoft’s Security Update Guide (MSRC), referenced by the NVD entry.
• Mechanism: according to the description, improper neutralisation of special elements used in a command (command injection) in Windows Shell allows an unauthorised attacker to bypass a security feature over a network. The sources do not say which security feature is bypassed.
• Severity: CVSS 3.1 8.8 (high), AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, assessed by Microsoft. The vector indicates a network attack of low complexity, with no privileges required but with user interaction, and high impact on confidentiality, integrity and availability. The type of interaction required (opening a file, a shortcut, a page) is not described.
• Weakness: CWE-77 (improper neutralisation of special elements used in a command).
• Indicators: no public indicators of compromise in the sources.
• MITRE ATT&CK: the sources do not describe the attack chain. The user interaction requirement maps in general to technique T1204 (User Execution); this is our own classification, not the advisory’s.

Impact for European and Italian organisations

Windows Shell is present on practically every Windows workstation, and workstations are where user interaction is most likely: the potential attack surface is therefore wide, even though exploitation requires an action by the victim. The sources do not say which sectors or countries have been hit, nor whether the attacks are targeted or large-scale.

For entities in scope of NIS2, the vulnerability falls under the vulnerability management required by the security measures: an exploited CVE with a three-day deadline for US agencies is a useful reference for setting internal priorities. A significant incident must be notified to the national CSIRT, which in Italy is CSIRT Italia at the National Cybersecurity Agency (ACN). In healthcare, where workstations access health data and often clinical systems, workstation updates should be scheduled without waiting for the ordinary cycle, taking into account workstations connected to medical devices that require vendor validation.

What to do now

1. Check the official list: look up CVE-2026-96951 in Microsoft’s Security Update Guide for the affected versions and the updates to install.
2. Patch as a priority: deploy the October 2026 Windows security updates, starting with user workstations and servers where users work interactively (for example remote desktop servers).
3. Verify installation: confirm from your update management tools that machines have actually received the package, including those off-site or switched off during the release days.
4. If you cannot patch right away: apply the mitigations listed by Microsoft in the vulnerability entry, as CISA requires.
5. Detect: in the absence of public indicators, check your endpoint protection tools for command-line processes started unusually by the Windows shell, and for alerts about system security features that have been disabled or bypassed.
6. Raise user awareness: exploitation requires user action; remind staff not to open unexpected files and links, even when they come from known contacts.

How ARXDOME helps

ARX Shield shows open vulnerabilities per machine and per package and highlights those already exploited by attackers, such as the CVEs in the KEV catalog, together with disconnected machines with critical vulnerabilities; if a workstation is suspicious, it lets you isolate it from the network. ARX Sentry collects logs and events from computers and servers, and ARX Horizon enriches every event with threat and vulnerability information.

Last updated: 13 October 2026