{"schema_version":"2","view":"grouped","data":[{"id":55771,"cve_ids":["CVE-2026-96951"],"payload":{"kind":"advisory","title":"Microsoft Windows Command Injection Vulnerability","summary":"Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network. CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","evidence":"kev:CVE-2026-96951","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-96951","aliases":["CVE-2026-96951"],"affected":[],"modified":"2026-10-13T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-77"],"cveID":"CVE-2026-96951","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-96951 ; BOD 26-04: BOD 26-04: Prioritizing Security Updates Based on Risk | CISA ; Forensics Triage Requirements: BOD 26-04: Implementation Guidance for Prioritizing Security Updates Based on Risk | CISA ;  https://nvd.nist.gov/vuln/detail/CVE-2026-96951","dueDate":"2026-10-16","product":"Windows","dateAdded":"2026-10-13","vendorProject":"Microsoft","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","known_exploited":true,"shortDescription":"Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.","vulnerabilityName":"Microsoft Windows Command Injection Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2026-96951","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:75f48784-ba00-4c81-9603-c5f8e0c3a2ae","priority":{"reasons":["linked_severity","known_exploited"],"severity":"high","linked_cves":[{"cve":"CVE-2026-96951","metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C"},"scenarios":[{"lang":"en-US","value":"GENERAL"}]}],"products":[{"name":{"value":"Outlook.com","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 10 Version 1607","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 10 Version 1809","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 10 Version 21H2","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 10 Version 22H2","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 11 version 23H2","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 11 Version 23H2","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 11 Version 24H2","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 11 Version 25H2","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 11 version 26H1","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 11 Version 26H2","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2012 R2","evidence":"/containers/cna/affected/11/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2012 R2 (Server Core installation)","evidence":"/containers/cna/affected/12/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2016","evidence":"/containers/cna/affected/13/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2016 (Server Core installation)","evidence":"/containers/cna/affected/14/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2019","evidence":"/containers/cna/affected/15/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2019 (Server Core installation)","evidence":"/containers/cna/affected/16/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2022","evidence":"/containers/cna/affected/17/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2025","evidence":"/containers/cna/affected/18/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2025 (Server Core installation)","evidence":"/containers/cna/affected/19/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-96951","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveID"}],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":2,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-96951","advisory_id":"75f48784-ba00-4c81-9603-c5f8e0c3a2ae","event_types":["advisory"],"published_at":"2026-10-25T15:40:33.050393+00:00","technologies":["core-kev","windows"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-13T00:00:00+00:00","detail_url":"/advisories/advisory%3A75f48784-ba00-4c81-9603-c5f8e0c3a2ae","group":{"id":"advisory:75f48784-ba00-4c81-9603-c5f8e0c3a2ae","revision":1,"primary_event_id":55300,"change":"published","superseded_by":[],"changed":{"id":55300,"cve_ids":["CVE-2026-96951"],"payload":{"kind":"advisory","title":"Microsoft Windows Command Injection Vulnerability","summary":"Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network. CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","evidence":"kev:CVE-2026-96951","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-96951","aliases":["CVE-2026-96951"],"affected":[],"modified":"2026-10-13T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-77"],"cveID":"CVE-2026-96951","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-96951 ; BOD 26-04: BOD 26-04: Prioritizing Security Updates Based on Risk | CISA ; Forensics Triage Requirements: BOD 26-04: Implementation Guidance for Prioritizing Security Updates Based on Risk | CISA ;  https://nvd.nist.gov/vuln/detail/CVE-2026-96951","dueDate":"2026-10-16","product":"Windows","dateAdded":"2026-10-13","vendorProject":"Microsoft","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","known_exploited":true,"shortDescription":"Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.","vulnerabilityName":"Microsoft Windows Command Injection Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2026-96951","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:75f48784-ba00-4c81-9603-c5f8e0c3a2ae","priority":{"reasons":["linked_severity","known_exploited"],"severity":"high","linked_cves":[{"cve":"CVE-2026-96951","metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C"},"scenarios":[{"lang":"en-US","value":"GENERAL"}]}],"products":[{"name":{"value":"Outlook.com","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 10 Version 1607","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 10 Version 1809","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 10 Version 21H2","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 10 Version 22H2","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 11 version 23H2","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 11 Version 23H2","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 11 Version 24H2","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 11 Version 25H2","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 11 version 26H1","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 11 Version 26H2","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2012 R2","evidence":"/containers/cna/affected/11/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2012 R2 (Server Core installation)","evidence":"/containers/cna/affected/12/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2016","evidence":"/containers/cna/affected/13/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2016 (Server Core installation)","evidence":"/containers/cna/affected/14/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2019","evidence":"/containers/cna/affected/15/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2019 (Server Core installation)","evidence":"/containers/cna/affected/16/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2022","evidence":"/containers/cna/affected/17/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2025","evidence":"/containers/cna/affected/18/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2025 (Server Core installation)","evidence":"/containers/cna/affected/19/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-96951","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveID"}],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":2,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-96951","advisory_id":"75f48784-ba00-4c81-9603-c5f8e0c3a2ae","event_types":["advisory"],"published_at":"2026-10-25T15:40:33.050393+00:00","technologies":["core-kev","windows"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-10-13T00:00:00+00:00","detail_url":"/events/55300"},"members":[{"id":55300,"cve_ids":["CVE-2026-96951"],"payload":{"kind":"advisory","title":"Microsoft Windows Command Injection Vulnerability","summary":"Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network. CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","evidence":"kev:CVE-2026-96951","products":[{"name":{"value":"Windows","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-96951","aliases":["CVE-2026-96951"],"affected":[],"modified":"2026-10-13T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-77"],"cveID":"CVE-2026-96951","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-96951 ; BOD 26-04: BOD 26-04: Prioritizing Security Updates Based on Risk | CISA ; Forensics Triage Requirements: BOD 26-04: Implementation Guidance for Prioritizing Security Updates Based on Risk | CISA ;  https://nvd.nist.gov/vuln/detail/CVE-2026-96951","dueDate":"2026-10-16","product":"Windows","dateAdded":"2026-10-13","vendorProject":"Microsoft","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","known_exploited":true,"shortDescription":"Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.","vulnerabilityName":"Microsoft Windows Command Injection Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2026-96951","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:75f48784-ba00-4c81-9603-c5f8e0c3a2ae","priority":{"reasons":["linked_severity","known_exploited"],"severity":"high","linked_cves":[{"cve":"CVE-2026-96951","metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C"},"scenarios":[{"lang":"en-US","value":"GENERAL"}]}],"products":[{"name":{"value":"Outlook.com","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 10 Version 1607","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 10 Version 1809","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 10 Version 21H2","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 10 Version 22H2","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 11 version 23H2","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 11 Version 23H2","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 11 Version 24H2","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 11 Version 25H2","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 11 version 26H1","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows 11 Version 26H2","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2012 R2","evidence":"/containers/cna/affected/11/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2012 R2 (Server Core installation)","evidence":"/containers/cna/affected/12/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2016","evidence":"/containers/cna/affected/13/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2016 (Server Core installation)","evidence":"/containers/cna/affected/14/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2019","evidence":"/containers/cna/affected/15/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2019 (Server Core installation)","evidence":"/containers/cna/affected/16/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2022","evidence":"/containers/cna/affected/17/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2025","evidence":"/containers/cna/affected/18/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Windows Server 2025 (Server Core installation)","evidence":"/containers/cna/affected/19/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-96951","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveID"}],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":2,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-96951","advisory_id":"75f48784-ba00-4c81-9603-c5f8e0c3a2ae","event_types":["advisory"],"published_at":"2026-10-25T15:40:33.050393+00:00","technologies":["core-kev","windows"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-10-13T00:00:00+00:00","detail_url":"/events/55300"}]}}],"next_after":55771,"next_before":55771}