CVE-2026-96951
Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
Am I affected?
Sign in and add the software you use to your watchlist: we check it against every new vulnerability.
CISA says: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Timeline
- Added to CISA known exploited list
- Published by NVD
- Last updated by NVD
- First covered by RedTeamDaily
Affected products
| Product | Versions |
|---|---|
| Microsoft Outlook Web | every version |
| Microsoft Windows 10 1607 | up to before 10.0.14393.9612 |
| Microsoft Windows 10 1809 | up to before 10.0.17763.9376 |
| Microsoft Windows 10 21h2 | up to before 10.0.19044.7807 |
| Microsoft Windows 10 22h2 | up to before 10.0.19045.7807 |
| Microsoft Windows 11 23h2 | up to before 10.0.22631.7652 |
| Microsoft Windows 11 24h2 | up to before 10.0.26100.9711 |
| Microsoft Windows 11 25h2 | up to before 10.0.26200.9711 |
| Microsoft Windows 11 26h1 | up to before 10.0.28000.3231 |
| Microsoft Windows 11 26h2 | up to before 10.0.26300.9711 |
| Microsoft Windows Server 2012 | version not stated |
| Microsoft Windows Server 2016 | up to before 10.0.14393.9612 |
| Microsoft Windows Server 2019 | up to before 10.0.17763.9376 |
| Microsoft Windows Server 2022 | up to before 10.0.20348.5761 |
| Microsoft Windows Server 2025 | up to before 10.0.26100.33650 |
Coverage
Sources: NVD and CISA known exploited vulnerabilities catalogue.