Critical command injection vulnerability in Windows Shell under active exploitation

CISA added a vulnerability in Microsoft Windows Shell that allows command injection (CVE-2026-96951) to the Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was added to the catalog on October 13, 2026, and is reportedly being actively exploited. The entry also carries a ransomware flag, meaning this vulnerability is counted among those used in ransomware campaigns.

According to Microsoft’s MSRC entry, the vulnerability has a CVSS 3.1 base score of 8.8 and a High severity rating. The attack can be carried out over the network, and the attacker does not need prior privileges; however, the user must trigger an action. On the impact side, confidentiality, integrity, and availability are all rated High.

What exactly does the vulnerability do?

The NVD entry describes the vulnerability as improper neutralization of special elements used in a command (CWE-77, command injection). This flaw in Windows Shell allows an unauthorized attacker to bypass a security feature over the network. In practice, the attacker can invoke commands that should normally be blocked and bypass the protection that controls them.

Which versions are affected?

The list of affected products is quite broad:

• Windows 10 versions 1607, 1809, 21H2, and 22H2
• Windows 11 versions 23H2, 24H2, 25H2, 26H1, and 26H2
• Windows Server 2012 R2, 2016, 2019, 2022, and 2025 versions (including Server Core installations)
• Web-based Outlook.com client (builds before version 20260925.100)

So almost all current Windows versions commonly used at home and in the office are on the list. Personal computers running Windows 10 and Windows 11 are also directly in scope.

What you need to do

Microsoft has published the fixed build numbers in the MSRC update guide, so a patch is available for the vulnerability. Open Windows Update, check for updates, and restart your computer if prompted. Cumulative security updates often do not take effect without a restart.

CISA set October 16, 2026 as the patching deadline for federal agencies for vulnerabilities on the KEV list. This deadline only binds official agencies; however, given that the vulnerability is being actively exploited and linked to ransomware, end users should not wait either.

Those who have turned off automatic updates and those who have postponed updates should prioritize this. Administrators of systems running Windows Server in corporate environments should also include the same patch in their plans.

Source: CISA KEV · NVD