Microsoft Windows Command Injection Vulnerability
CVE-2026-96951 is a security vulnerability in Microsoft Windows, added to CISA KEV on October 13, 2026. Patch order: third of four.
What is CVE-2026-96951?
Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.
Who is affected by CVE-2026-96951?
Affects anyone running Windows workstations or servers. In a small CPA, legal, or dental practice, Windows is typically the platform your accounting, document management, or practice management software runs on — exploitation gives an attacker access to whatever client files and credentials live on those machines.
What should I do about CVE-2026-96951?
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
If you don't have someone in-house to verify the patch deployed across every endpoint — or you're not sure whether you're affected — that's exactly the kind of triage we do. Request a free review.
Insurance readiness
Your insurer will ask if this is patched.
Unpatched entries on CISA's Known Exploited Vulnerabilities list are exactly what cyber-insurance carrier questionnaires probe for, and knowing which controls they check is how you keep a renewal from stalling.
Get the free carrier questionnaire →Severity
CVSS base score: 8.8 — HIGH
Weakness classification: CWE-77
CISA due date
CISA's listed due date: October 16, 2026.
Federal civilian agencies work under CISA's Binding Operational Directive 26-04, which replaced BOD 22-01 on June 10, 2026. It sets the deadline for each affected system by:
- How exposed that system is to the internet
- Whether the attack can be automated
- How much control it gives an attacker
Its table gives catalogued vulnerabilities 3 or 14 days.
None of this binds a private business, but treat the date as a strong recommendation, especially if you handle regulated data (HIPAA, GLBA, ABA model rules).
Other exploited Microsoft Windows entries
More CISA KEV entries for Microsoft Windows. Same product line, same actively-exploited status.
Source
This entry comes from CISA's Known Exploited Vulnerabilities catalog, public US-Government data we pull daily. The plain-language framing and the what-to-do guidance above are ours. View the original entry on cisa.gov.