Zero Radar
← feed
CriticalVulnerabilityCVE-2026-96951updated 29 Oct 2026, 16:24 UTC

Windows Shell command injection lets attackers bypass security over a network

A flaw in a core part of Windows lets an outsider sneak commands into the system and get past a protection feature, without needing a password. Attackers are already using it.

Exploited (CISA KEV, NVD)Official, 3 sources
SeverityCriticalCVSS 8.8 of 10
Being exploited?YesConfirmed by CISA KEV, NVD · 13 Oct 2026
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 3 sourcesBacked by an official source

How the attack works simplified

  1. 1Remote attackerSends crafted input over the network
  2. 2Network accessNo login or prior access required
  3. 3Windows ShellSpecial characters not neutralized
  4. 4Security bypassProtection feature is circumvented
  5. ResultAttacker bypasses Windows protections remotely

What happened

Microsoft Windows Shell has a command injection flaw (CWE-77 improper neutralization of special elements) that lets an unauthorized network attacker bypass a security feature.

Why it is dangerous: Attackers can reach affected Windows machines over the network and bypass protections, which can lead to further compromise. Organizations with internet-exposed Windows systems are at highest risk.

Are you affected?

You are affected if you run a Windows version that includes the vulnerable Windows Shell component and have not applied Microsoft's update for CVE-2026-96951.

Microsoft Windows (vulnerable Windows Shell component; specific versions not stated in the provided material)

What to do

  1. Apply Microsoft's security update for CVE-2026-96951 from the MSRC update guide
  2. If no update is available yet, follow CISA BOD 26-04 and vendor mitigation instructions
  3. Prioritize internet-exposed Windows systems and review them for signs of compromise
  4. Discontinue use of the affected product where mitigations are unavailable

Timeline

  1. 13 Oct 2026, 00:00 UTC
    Publicly disclosed
  2. 13 Oct 2026, 00:00 UTC
    Reported by CISA KEV · CISA KEV
  3. 25 Oct 2026, 17:35 UTC
    GitHub Advisory reported on it · GitHub Advisory
  4. 29 Oct 2026, 16:24 UTC
    NVD reported on it · NVD

Sources 3 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-96951 · GHSA-hjr5-mppg-mjq7
CVSS
8.8 / 10
EPSS
9.8% chance of exploitation within 30 days
Disclosed
13 Oct 2026, 00:00 UTC
On Zero Radar
before the radar started
Last change
29 Oct 2026, 16:24 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Windows Shell command injection lets attackers bypass security over a network · Zero Radar