CVE-2026-96951
Microsoft — Windows Shell Security Feature Bypass Vulnerability
Patch Tuesday
What EVULNABLE says
Listed in the CISA KEV catalog, and an EPSS probability of 0.015.
Patch This Cycle
The priority band answers “how soon”, not “how bad” — see Methodology for what it weighs and where it abstains.
Our write-up
A command injection flaw in Windows Shell lets attackers bypass Mark of the Web protections using a crafted file sent by email or instant message, and it is being exploited in the wild.
Affected: Windows 10, Windows 11 and Windows Server 2012 R2 through 2025.
Fix: Install the October cumulative update and reboot.
Updated Oct 14, 2026. Changed: Reformatted into summary, affected systems and fix.
AI-written summary, Oct 14, 2026 Confirm details in the vendor advisory before acting. Source: CISA KEV
The evidence behind it
| Measure | Value | Source | What it means |
|---|---|---|---|
| CVSS base score | 8.8 | — | How severe the flaw is in itself. It does not say how likely an attack is. |
| FIRST EPSS | 0.015 (74th pctl) | FIRST | FIRST's estimate of the chance this is exploited in the next 30 days, and how that ranks against all CVEs. |
| Actively exploited | Confirmed | CISA KEV | Whether a source of record has confirmed attacks using it in the wild. |
| Ransomware campaign use | Unknown or none | CISA KEV | Whether CISA has seen ransomware operators use it. |
| CISA remediation deadline | — | CISA KEV | The date US federal agencies must have fixed or mitigated it. |
| Fixed in | windows 10 1607: update to 10.0.14393.9612 or later | windows 10 1809: update to 10.0.17763.9376 or later | windows 10 21h2: update to 10.0.19044.7807 or later | windows 10 22h2: update to 10.0.19045.7807 or later | windows 11 23h2: update to 10.0.22631.7652 or later | windows 11 24h2: update to 10.0.26100.9711 or later | NVD | The version(s) the vendor has published as fixed, where NVD records one. |
| Public exploit module | None known | Metasploit | Module existing is not the same as active exploitation. |
| EUVD cross-reference | Listed | ENISA EUVD | ENISA's own vulnerability database entry for this CVE, where one exists. |
Impacted software or hardware
- outlook web Software
- windows 10 1607 Operating system — < 10.0.14393.9612
- windows 10 1809 Operating system — < 10.0.17763.9376
- windows 10 21h2 Operating system — < 10.0.19044.7807
- windows 10 22h2 Operating system — < 10.0.19045.7807
- windows 11 23h2 Operating system — < 10.0.22631.7652
- windows 11 24h2 Operating system — < 10.0.26100.9711
- windows 11 25h2 Operating system — < 10.0.26200.9711
+7 more affected products — see the full list at NVD.
Fixed versions: windows 10 1607: update to 10.0.14393.9612 or later | windows 10 1809: update to 10.0.17763.9376 or later | windows 10 21h2: update to 10.0.19044.7807 or later | windows 10 22h2: update to 10.0.19045.7807 or later | windows 11 23h2: update to 10.0.22631.7652 or later | windows 11 24h2: update to 10.0.26100.9711 or later
Remediation: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Remediation basis: CISA KEV required action
ENISA EUVD also lists this CVE at CVSS 8.8 (v3.1), assigned by microsoft. Source: euvd.enisa.europa.eu.
2 days recorded, 2026-10-14 to 2026-10-15
1.51% as of 2026-10-15 (74th percentile). FIRST EPSS, recorded daily since this page started tracking it.
2026-10-14
2026-10-15
The primary records
This page is an opinion about urgency. Where it and a source of record disagree, the source of record is the record.
Where this sits
CVE-2026-96951 is one of the entries ranked on the priority feed and in this month's Microsoft release.