CVE-2026-96951: Windows Shell Command Injection Under Attack

CVE-2026-96951: Windows Shell Command Injection Under Attack

What CVE-2026-96951 is and who is affectedCVE-2026-96951 is a command injection vulnerability in Microsoft Windows Shell, officially named "Microsoft...

What CVE-2026-96951 is and who is affected

CVE-2026-96951 is a command injection vulnerability in Microsoft Windows Shell, officially named "Microsoft Windows Command Injection Vulnerability". The NVD classifies it as improper neutralisation of special elements used in a command (CWE-77), and describes the impact plainly: an unauthorised attacker can bypass a security feature over a network. CISA uses almost the same wording in its own description.

Cracked padlock next to a laptop on an office desk, representing an exploited Windows Shell command injection flaw

The severity score is CVSS 3.1 8.8, rated HIGH, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. In practice that means the attack can be launched remotely over the network, needs no privileges and no special conditions, but does require some form of user interaction. Confidentiality and integrity impacts are both rated high. The NVD published the entry on 2026-10-13.

Because the flaw sits in Windows Shell, the exposure is not limited to a single application. Any organisation running affected Windows systems — including the workstations and servers behind a WordPress, PrestaShop or Joomla site — should treat this as relevant to their estate. The material does not specify which Windows versions are affected, so the authoritative list must be taken from Microsoft's own update guide for this CVE.

Why this is urgent: it is already being exploited

This is not a theoretical risk. CISA added CVE-2026-96951 to its Known Exploited Vulnerabilities (KEV) catalogue on 2026-10-13, which means there is confirmed evidence of exploitation in real attacks. Once a vulnerability reaches the KEV catalogue, the window between disclosure and active abuse has already closed.

CISA has given US federal agencies until 2026-10-16 to remediate it — a three-day deadline that reflects how seriously the flaw is being treated. The required action is to apply mitigations in accordance with vendor instructions, in line with CISA's BOD 26-04 guidance on prioritising security updates based on risk, and to follow the applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. CISA also stresses that each asset's internet exposure must be evaluated individually.

One important caveat: the material states that no use in ransomware campaigns is known at this time. That is not a reason to relax. Command injection flaws are frequently used as an initial foothold, and the absence of a ransomware link today says nothing about next month.

What to do today

  • Check whether you run the affected product and which version. Confirm which Windows builds are in scope by consulting Microsoft's update guide for CVE-2026-96951, published at msrc.microsoft.com. Do not rely on assumptions about your fleet — verify.
  • Apply the update or mitigation exactly as the vendor advisory instructs. The material does not name a fixed version, so follow whatever Microsoft's advisory specifies. Where a patch is not yet applicable, apply the mitigations it describes; if no mitigation exists for a given asset, CISA's guidance is to discontinue use of the product.
  • Look for signs of intrusion. Since exploitation is confirmed in the wild, patching alone is not enough. Review logs and system behaviour on any host that was exposed before remediation, and follow CISA's forensics triage requirements where an incident is suspected.
  • Reduce what is reachable from the internet. CISA explicitly asks asset owners to evaluate each system's internet exposure. Services that do not need to be public should not be, and administrative interfaces should sit behind a VPN or an allowlist.
  • Prioritise by risk, not by convenience. Internet-facing systems, and those holding customer or payment data, come first — the same logic behind BOD 26-04.

How a cybersecurity team such as ALMC's can help

For a small or mid-sized company in Barcelona, Lleida, Tarragona or Girona, the hard part is rarely reading the advisory — it is knowing which of your machines are affected, whether anything got in before you patched, and what to close off afterwards. That is the work ALMC does every day: security audits and pentesting to find the gaps before someone else does, server hardening, monitoring and incident response, and ongoing maintenance and updating of WordPress, PrestaShop and Joomla installations, which are often the first thing an attacker probes.

If a site has already been compromised, we also handle the recovery of hacked websites, cleaning the intrusion and closing the entry point rather than simply restoring a backup that still contains the flaw. With a vulnerability like CVE-2026-96951 already in the KEV catalogue, the sensible move is to confirm your exposure now, apply the vendor's guidance, and put a process in place so the next critical CVE does not catch you by surprise.

Related

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.