Windows Shell Security Feature Bypass Vulnerability

Description

Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.

Affected Products

Vendor	Product	Versions
microsoft	windows	1.0.0, 10.0.14393.0, 10.0.17763.0, 10.0.19044.0, 10.0.19045.0, 10.0.22631.0, 10.0.22631.0, 10.0.26100.0, 10.0.26200.0, 10.0.28000.0, 10.0.26300.0, 6.3.9600.0, 6.3.9600.0, 10.0.14393.0, 10.0.14393.0, 10.0.17763.0, 10.0.17763.0, 10.0.20348.0, 10.0.26100.0, 10.0.26100.0

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951(vendor-advisory, patch)

Related News (3 articles)

Tier C

Cisco Talos1h ago

Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities

→ No new info (linked only)

Tier B

CCCS Canada2h ago

Microsoft security advisory – October 2026 monthly rollup (AV26-1038)

→ No new info (linked only)

Tier A

Microsoft MSRC8h ago

CVE-2026-96951 Windows Shell Security Feature Bypass Vulnerability

→ No new info (linked only)

Discussion (0)

Loading…

CVSS 3.18.8 HIGH

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

CISA KEV✅ Yes

Actively exploited✅ Yes

Patch available

20260925.10010.0.14393.961210.0.17763.937610.0.19044.780710.0.22631.765210.0.26100.971110.0.26200.971110.0.28000.323110.0.26300.97116.3.9600.2347010.0.20348.576110.0.26100.33650

CWECWE-77

PublishedOct 13, 2026

Last enriched2h ago

Trending Score131🔥

Source articles3

Independent3

Info Completeness5/14

Missing: vendor, product, versions, epss, kev, exploit, patch, iocs, mitre_attack