CISA added CVE-2026-96951 to its Known Exploited Vulnerabilities catalog on October 13. The flaw is in Windows Shell, and CISA says attackers are exploiting it to bypass a security feature over a network. Windows desktop and server administrators have an immediate patch-priority decision; the federal remediation date in the catalog is October 16.
The Microsoft-authored CVE record names a wider set of affected products than the catalog’s Windows label: it also lists Outlook.com. For Windows defenders, the useful first move is to map installed OS builds against that record, then get the appropriate security updates into the rollout. Track Outlook.com separately as a Microsoft-hosted service entry in the affected list.
A network path requires interaction
Microsoft describes the flaw as “Improper neutralization of special elements used in a command” in Windows Shell. That is CWE-77, a command-injection weakness. The stated consequence is security-feature bypass by an unauthorized attacker over a network. The Microsoft CVSS vector scores it 8.8 and marks both network attack vector (AV:N) and required user interaction (UI:R); scope both network reachability and the required user interaction. CISA’s exploitation listing establishes real-world use, while its ransomware-use field is marked Unknown.
Use affected-build inventory to prioritize systems, and investigate suspicious activity with your established endpoint and incident-response telemetry. Treat the delivery path as unresolved when deciding which systems to isolate; a presumed listening service or command-line signature could miss the activity.
Windows builds span several generations
Microsoft lists Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2 through 26H2; and Windows Server 2012 R2, 2016, 2019, 2022 and 2025, including listed Server Core installations. Match the specific edition and architecture in the CVE record. Its affected ranges end before build 10.0.22631.7652 for Windows 11 23H2, 10.0.26100.9711 for Windows 11 24H2, 10.0.20348.5761 for Server 2022, and 10.0.26100.33650 for Server 2025. Compare each installed build with the boundary for its own release. The Windows 10 22H2 row is an exception: Microsoft lists a 10.0.19045.0 starting version with a 10.0.19044.7807 upper bound. For Windows 10 22H2, use update-installation status to verify the applicable security update because the recorded bounds cross build branches.
The NVD record carries the same Microsoft affected-product list and CISA’s October 16 action date. Microsoft also lists Outlook.com versions below 20260925.100; track that service entry separately from Windows patch deployment.
Patch and verify affected endpoints
Pull a Windows OS version-and-build report from your endpoint and server inventory. Compare each machine’s branch with the Microsoft-authored affected range, then put affected machines into the patch queue. Prioritize externally exposed systems and user-facing endpoints: Microsoft’s UI:R rating describes an interaction condition, while CISA records active exploitation.
Deploy the applicable Microsoft security update through your normal update system. For a machine that cannot be updated promptly, record an exception, reduce its exposure, and follow CISA’s vendor-mitigation and forensics-triage direction if compromise is a concern.
Verify the rollout by sampling installed builds against the matching CVE branch; the expected result is a build at or above its listed boundary. Check update-installation status separately for Windows 10 22H2, whose recorded bound crosses build branches. Investigate machines still below their threshold using available endpoint telemetry and CISA’s triage requirements. The October 16 date is a federal-agency requirement under CISA’s direction and an escalation point for other defenders facing this exploited flaw.