Microsoft Windows Shell flaw lands in CISA exploited catalog

CISA added CVE-2026-96951, a Windows Shell command-injection security-feature bypass, to its Known Exploited Vulnerabilities catalog on October 13. The catalog marks it exploited and assigns federal agencies an October 16 action date. Microsoft’s CVE record describes an unauthorized network attacker and a CVSS:3.1 vector with user interaction required (UI:R). Treat network reachability and an interaction path as separate questions; prioritize by installed build and investigate suspicious activity with your existing endpoint telemetry.

Microsoft lists Windows 10 1607, 1809, 21H2 and 22H2; Windows 11 23H2 through 26H2; Windows Server 2012 R2, 2016, 2019, 2022 and 2025; and Outlook.com. The service entry belongs on a separate tracking line from your Windows update rollout. For example, the Windows 11 24H2 affected range ends before build 10.0.26100.9711, while Server 2022 ends before 10.0.20348.5761; compare each machine with its own branch in the Microsoft-authored CVE record. The Windows 10 22H2 row mixes 19045 and 19044 build branches; verify its applicable security update through deployment tooling because the recorded bounds cross build branches.

Export desktop and server build inventory, prioritize externally exposed machines and user-facing endpoints, and deploy the applicable vendor security updates. Record exceptions, reduce their exposure and follow CISA’s forensics-triage direction where compromise is a concern. Verify by sampling installed builds after rollout against their matching branch, and confirm update-installation status for Windows 10 22H2; remaining vulnerable builds need update or an explicit exception and incident review. CISA marks ransomware campaign use Unknown.