Key points
- The flaw allows command injection in Windows Shell to bypass security features.
- Microsoft confirmed the vulnerability was exploited in the wild as a zero-day.
- The October 2026 update addresses this issue with a CVSS score of 8.8.
Microsoft released a fix for CVE-2026-96951 in its October 2026 Patch Tuesday update. This vulnerability affects the Windows Shell component on Windows systems. According to Microsoft, attackers successfully exploited this flaw in the wild before the patch was available. The issue allows an unauthorized attacker to bypass a security feature over a network.
In plain English
The vulnerability is a command injection flaw in the Windows Shell. Attackers can use social engineering, such as email or messages, to trick users into opening malicious files. When the file is opened, the flaw allows the attacker to bypass the Mark of the Web (MOTW) security feature. This bypass lets malicious code run despite standard Windows protections.
The background
CVE-2026-96951 received a CVSSv3 score of 8.8, which rates it as high severity. It is classified as a security feature bypass. This is the third Windows Shell flaw exploited in the wild in 2026. Previous incidents included CVE-2026-21510 in February and CVE-2026-32202 in April. Microsoft included the patch in a large update addressing 1,407 CVEs.
What changes now
Administrators must apply the October 2026 security update to remediate this specific issue. The patch neutralizes the command injection vector in the Shell. CISA added the CVE to its Known Exploited Vulnerabilities catalog on October 13, 2026. Federal agencies have a due date of October 16, 2026, to comply with patching guidance.
Who needs to act first
Teams should prioritize systems that face the internet or handle untrusted user input. Check whether endpoints receive emails from unknown sources, as social engineering is the primary attack vector. Roll out the update to a small test group first to verify stability. Back up critical data before applying changes. Monitor logs for unusual command execution that might indicate prior compromise.
What to do and how to stay safe: Microsoft
- Install the October 2026 Microsoft security update on all affected Windows devices.
- Verify that the Mark of the Web feature is enabled and functioning correctly.
- Train users to recognize social engineering attempts via email or messaging.
- Monitor network traffic for signs of command injection or bypass attempts.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-96951?
It is a command injection vulnerability in Windows Shell that allows attackers to bypass the Mark of the Web security feature.
Was this vulnerability exploited before the patch?
Yes, Microsoft confirmed that CVE-2026-96951 was exploited in the wild as a zero-day prior to the October 2026 update.
How severe is this flaw?
The National Vulnerability Database rates CVE-2026-96951 with a CVSS score of 8.8, which is considered high severity.
