CVE-2026-96951
Command injection in Outlook.com and Windows Shell lets attackers bypass security features.
This is a command injection flaw in Windows Shell as used by Microsoft Outlook.com. Command injection means an attacker can make the system run commands by sending specially crafted input over a network. Affected users include Outlook.com customers and Windows systems listed in the advisory, and Microsoft has released fixes; CISA has added it to its known-exploited list because it is actively used.
Microsoft Windows · Updated 28 Oct · From 2 of our stories and the public records
Being exploitedYesAttackers are using it
CISA known exploitedListedAdded 13 Oct; US agencies must fix by 16 Oct
SeverityhighCVSS 8.8 of 10
FixAvailableFixed versions below
Am I affected?
If you run a version older than the fixed one for your line, yes.
| Version line | Fixed in |
|---|---|
| Outlook.com 20260925.100 | 20260925.100 |
| Windows 11 version 26H1 10.0 | 10.0.28000.3231 |
| Windows 11 Version 26H2 10.0 | 10.0.26300.9711 |
| Windows 11 Version 25H2 10.0 | 10.0.26200.9711 |
What to do
- Apply the October 2026 security updates from Microsoft as soon as possible, because CISA says the flaw is actively exploited.
- For Outlook.com, make sure it is updated to version 20260925.100 or later.
- For Windows, install the cumulative update listed for your specific Windows version.
- US federal agencies must apply the fix by 2026-10-16 to meet CISA's required deadline.
What happened
- 13 OctCISA adds CVE-2026-96951 to its known-exploited list and requires US federal agencies to fix by 2026-10-16.
- 14 OctMicrosoft releases Windows 11 October updates that include patches for a record number of vulnerabilities, including this one.
- 28 OctCoverage says the October security update fixes 1,415 vulnerabilities, including one exploited in the wild.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-96951 | Windows Shell Security Feature Bypass Vulnerability | high 8.8 | 13 Oct | 9.8% |
Our reporting
28 OctMicrosoft October security update fixes 1,415 vulnerabilities, one exploited in the wild14 OctWindows 11 October update adds Emoji 17.0 and patches record 1,400+ security flawsReported elsewhere
InfoQ · 28 OctMicrosoft's October Security Update Fixes 1,400+ Vulnerabilities, One Exploited in the Wild ↗The records
msrc.microsoft.com: advisory ↗CISA known-exploited catalog ↗CVE-2026-96951 on NVD ↗Is anything you run affected?Members connect Zotpaper to their AI assistant. It checks your own project against every vulnerability on this page and the others we track, and says what to update.
How it works