Windows Shell: Security feature bypass via command injection
Deadline for US federal agencies: 16 Oct 2026
Summary
A command injection flaw in the Windows Shell allows an unauthorized remote attacker to bypass a security feature. The affected feature is Mark of the Web, which marks files from outside the local network. Microsoft reports active exploitation, and CISA has added the flaw to its Known Exploited Vulnerabilities catalog. No authentication is needed, but a user must interact, for example by opening a crafted file received by email or instant message.
Affected
- Windows 10 Version 1607 before 10.0.14393.9612
- Windows 10 Version 1809 before 10.0.17763.9376
- Windows 10 Version 21H2 before 10.0.19044.7807
- Windows 10 Version 22H2 before 10.0.19045.7807
- Windows 11 version 23H2 before 10.0.22631.7652
- Windows 11 Version 24H2 before 10.0.26100.9711
- Windows 11 Version 25H2 before 10.0.26200.9711
- Windows 11 version 26H1 before 10.0.28000.3231
- Windows 11 Version 26H2 before 10.0.26300.9711
- Windows Server 2012 R2 (including Server Core) before 6.3.9600.23470
- Windows Server 2016 before 10.0.14393.9612
- Microsoft Edge (Chromium-based) before 154.0.4258.62
- Outlook.com before 20260925.100 (cloud service)
Fixed in
- Versions at or above the thresholds listed under Affected, as stated in the CVE record
- Outlook.com: fixed by Microsoft on the service side, no customer action required
- Confirm exact build numbers in the MSRC Security Update Guide
Workaround
Unknown. Patching is the only documented fix.
Exploitation
- Exploitation detected: yes, per Microsoft and CISA
- CISA added the flaw to the KEV catalog on 13 October 2026 (due date 16 October 2026 for US federal agencies)
- Microsoft describes delivery via a crafted file sent by email or instant message
- Public proof of concept: conflicting reports, unverified
- Campaign details, threat actors and payloads: unknown
Our recommendation
- Patch all affected Windows clients and servers now, starting with user workstations
- Check whether Edge and other listed components are updated
- Keep strict email and chat attachment filtering, especially for archive and disk image files
- Keep Office Protected View and macro restrictions enabled
- Review endpoint logs from before patching for unexpected child processes
- Outlook.com customers need no action
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Security feature bypass – Windows Shell
- Status on Patch Tuesday
- Exploited (zero-day)
- Exploitability assessment
- Exploitation detected
- Product family
- Windows, Windows ESU (Extended Security Updates), Microsoft Office, Browser (Edge)
- Updates (KB)
- KB5126836, KB5126868, KB5126651, KB5126657, KB5126655, KB5126653
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-96951 msrc.microsoft.com
- CISA Known Exploited Vulnerabilities Catalog: CVE-2026-96951 www.cisa.gov
- CISA alert: two known exploited vulnerabilities added to catalog www.cisa.gov
- Security Affairs: CISA adds Windows Shell flaw to KEV catalog securityaffairs.com
- Threat Frontier: Windows Shell CVE-2026-96951 MOTW bypass exploited threatfrontier.com
- Mallory: CVE-2026-96951 mallory.ai
- SOCPrime: CVE-2026-96951 analysis socprime.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 13:35.
Original description (NVD)
Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
Required action (CISA)
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.