Signal is active with 61 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-10-16. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Priority
LOW
Exploitation
ACTIVE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 15 products
🚨 Microsoft just broke its Patch Tuesday record: 1,413 vulnerabilities patched in one release. One Windows Shell flaw (CVE-2026-96951) is already being exploited in attacks and can bypass Mark of the Web defenses. Read: https://thehackernews.com/2026/10/microsoft-patches-record-1413-flaws.html
📢 Microsoft Patch Tuesday — Octubre 2026 🔐 Récord histórico: 1.411 fallos corregidos 😱 🔴 Destacados: - ⚠️ 3 zero-days: 1 explotada activamente + 2 divulgadas públicamente - 🎯 70 vulnerabilidades críticas (57 de ejecución remota de código) - 🛠️ Una de ellas (CVE-2026-96951) permite saltarse el "Mark of the Web" de Windows Shell 📊 Por categoría: - 🔺 677 elevación de privilegios - 💥 317 ejecución de código remoto - 👁️ 254 divulgación de información Tienen un PDF publicado por Microsoft con todas las vulnerabilidades abordadas. https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/msrc/images/partner-images/2026cves.pdf
The three zero-days patched in Microsoft's October Patch Tuesday are: 🔥 CVE-2026-96951 – Actively exploited Windows Shell flaw lets attackers bypass Mark of the Web protections. ⚠️ CVE-2026-108398 – Publicly disclosed .NET Framework flaw allows attackers to bypass Windows Defender Application Control (WDAC). ⚠️ CVE-2026-92707 – Publicly disclosed MessagePack-CSharp flaw allows denial-of-service attacks.
🛡️We added Microsoft Windows command injection vulnerability CVE-2026-96951 to our KEV Catalog. Visit https://go.dhs.gov/Z3Q & apply mitigations to protect your org from cyberattacks. #Cybersecurity #InfoSec https://t.co/1dSqAEG9VZ
🚨 MICROSOFT WINDOWS SHELL FLAW ADDED TO CISA KEV (CVE-2026-96951) CISA added a Microsoft Windows Shell command-injection vulnerability to the Known Exploited Vulnerabilities catalog today. Microsoft rates it CVSS 3.1 8.8 (HIGH). Federal civilian agencies have a BOD 26-04 due date of October 16, 2026. • CVE-2026-96951 — Improper neutralization of special elements used in a command (CWE-77) in Windows Shell • Impact: an unauthorized attacker can bypass a security feature over a network (user interaction required) • CVSS 3.1: 8.8 HIGH · AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (Microsoft CNA) • Affected: multiple Windows 10/11 client and Windows Server builds listed on MSRC • Fix: apply the updates listed in Microsoft’s Security Update Guide for CVE-2026-96951 • CISA KEV added Oct 13, 2026 · federal (BOD 26-04) due date Oct 16, 2026 ⚠️ Analyst Note: CISA listing means confirmed exploitation in the wild. Prioritize internet-facing and user-facing Windows endpoints that process untrusted files or links, then verify the October cumulative updates actually installed. MSRC: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951 CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-96951 #DDW #DarkWeb #Microsoft #Windows #ZeroDay #CVE #CISA #KEV #ThreatIntelligence #CyberSecurity
🚨【Windowsで悪用確認】 2026年10月13日公開、CVE-2026-96951。 Windows Shellのコマンド注入で保護機能を回避されるおそれ！ 悪用確認済みのため、修正更新を適用しましょう！ #Windows #脆弱性 #企業公式相互フォロー
先月も1000件弱だったけど、今月は1400件超えだって。なんかもう件数で騒ぐ時代は終わったと思うなー。（まぁ件数で騒ぐのは前から違うと思ってるけど） KEV（https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-adds-two-known-exploited-vulnerabilities-catalog）にも入ってるねこれは。 CVE-2026-96951 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951 Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days https://www.bleepingcomputer.com/news/microsoft/microsoft-october-2026-patch-tuesday-fixes-1-411-flaws-3-zero-days/
Attackers are already sending Windows users files that open without the "this came from the internet" warning. That warning is often the only thing between a click and malware. Microsoft fixed it today. Install the October Windows update and restart. https://hol.org/blog/cve-2026-96951-windows-shell-mark-of-the-web-bypass https://t.co/HzNWoBVI82
1,411 fixes. Largest Patch Tuesday in 23 years 70 Critical 3 zero-days 1 exploited in the wild. Patch order first thing : Windows Shell CVE-2026-96951, the five Outlook reading pane RCEs, Exchange, your DCs. Free detection pack, 10 Sigma + 10 KQL, no signup: https://www.threathunter.ai/blog/october-2026-patch-tuesday-1411-fixes/
The exploited one is CVE-2026-96951, a Windows Shell Mark of the Web bypass, CVSS 8.8. It strips the tag that triggers SmartScreen and Protected View. Phishing attachment, no warning https://t.co/0LotDCF8PY
Microsoft Patch Tuesday — October 2026 1419 vulnerabilities patched 1 actively exploited zero-day: 🔴 CVE-2026-96951 (Windows Shell) CVSS 8.8 Critical: 77, Important: 1337, Low: 1 2 publicly disclosed 109 marked "Exploitation More Likely" Full analysis: https://aretiq.ai/bulletins/microsoft-october-2026/
October Patch Tuesday: Microsoft confirms active exploitation of CVE-2026-96951, a Windows Mark of the Web bypass. Our FIRE team examines this and other vulnerabilities in the latest security updates. https://hubs.la/Q04B5LJS0 https://t.co/MbLZSu7FhJ
🚨 CyberRakshakLabs (https://cyberrakshaklabs.in/) — Incident Summary 🚨 Microsoft has addressed CVE-2026-96951 #CyberSecurity #WindowsSecurity #ZeroDay #VulnerabilityManagement #ThreatIntelligence #CyberRakshakLabs https://t.co/S3h2oLdUEs
🚨 CyberRakshakLabs (https://cyberrakshaklabs.in/) — Incident Summary 🚨 Microsoft has addressed CVE-2026-96951 #CyberSecurity #WindowsSecurity #ZeroDay #VulnerabilityManagement #ThreatIntelligence #CyberRakshakLabs https://t.co/nQi5O9CT1l
Microsoft just dropped 1,413 CVEs. One is already exploited. CVE-2026-96951 = Mark-of-the-Web bypass → RCE via crafted RAW image. 73+ Critical. If you handle images in browser/email, patch NOW. #InfoSec #PatchTuesday #CVE202696951 https://t.co/rh9EjxHh37
Actively exploited Windows Shell flaw CVE-2026-96951 can bypass Mark of the Web. Prioritise Microsoft's fix and check affected systems. Contact FORTBRIDGE for support. #CyberSecurity #PatchTuesday https://t.co/UNKxOMJMto
🔐 Microsoft October 2026 Patch Tuesday — 1,413 CVEs Zero-day in the wild: CVE-2026-96951 (CVSS 8.8) Windows Shell command injection bypasses Mark of the Web. CISA KEV — deadline Oct 16. 🔗 https://threataft.com/articles/microsoft-october-2026-patch-tuesday-cve-2026-96207 #PatchTuesday #CVE #Microsoft #Infosec #CyberSecurity
🚨 Microsoft, Ekim 2026 Patch Tuesday kapsamında devasa sayıda, toplam 1.415 açık için güvenlik güncellemesi yayınladı. Açıkların 85'i kritik, 67'si ise RCE (uzaktan kod çalıştırma) kategorisinde. Öne çıkanlar: 🔴 CVE-2026-100202 — Windows Message Queuing, CVSS 9.8 🔴 CVE-2026-70229 — Active Directory Domain Services, RCE 🔴 CVE-2026-70571 — Exchange Server, RCE ⚠️ CVE-2026-96951 — Windows Shell, güvenlik mekanizmasını atlatma (CVSS 8.8) Microsoft, bu ayki açıklardan birinin aktif olarak istismar edildiğini de doğruladı. Sistemlerinizi güncellemeyi ihmal etmeyin. releaseNote: https://msrc.microsoft.com/update-guide/releaseNote/2026-Oct
ARETIQ Daily Vulnerability Bulletin — October 13, 2026 🔴 CRITICAL: CVE-2026-104935 (ivanti/connect_secure) AAS 14.0 — exploited ITW (CISA KEV) 🔴 CRITICAL: adobe/adobe_commerce (2 CVEs) AAS 13.9 🔴 CRITICAL: CVE-2026-96951 (microsoft/outlook.com) AAS 13.6 — exploited ITW (CISA KEV) 🔴 CRITICAL: CVE-2026-97229 (gitlab/gitlab) AAS 12.4 108 vulnerabilities — CRITICAL: 5, HIGH: 103 Full bulletin: https://aretiq.ai/bulletins/2026-10-13/
تحديث مايكروسفت هذا الشهر يغلق 1,413 ثغره وحده منهم تستغل حالياً وهي Windows Shell flaw (CVE-2026-96951) حدث ياصديقي واستعد للمشاكل بعد التحديث كالعاده 😅 https://t.co/RCy1lr1Zgp
26 of 26 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | microsoft | outlook_web | - | - | - |
| OS | microsoft | windows_10_1607 | - | - | x64 |
| OS | microsoft | windows_10_1607 | - | - | x86 |
| OS | microsoft | windows_10_1809 | - | - | x64 |
| OS | microsoft | windows_10_1809 | - | - | x86 |
| OS | microsoft | windows_10_21h2 | - | - | arm64 |
| OS | microsoft | windows_10_21h2 | - | - | x64 |
| OS | microsoft | windows_10_21h2 | - | - | x86 |
| OS | microsoft | windows_10_22h2 | - | - | arm64 |
| OS | microsoft | windows_10_22h2 | - | - | x64 |
| OS | microsoft | windows_10_22h2 | - | - | x86 |
| OS | microsoft | windows_11_23h2 | - | - | arm64 |
| OS | microsoft | windows_11_23h2 | - | - | x64 |
| OS | microsoft | windows_11_24h2 | - | - | arm64 |
| OS | microsoft | windows_11_24h2 | - | - | x64 |
| OS | microsoft | windows_11_25h2 | - | - | arm64 |
| OS | microsoft | windows_11_25h2 | - | - | x64 |
| OS | microsoft | windows_11_26h1 | - | - | arm64 |
| OS | microsoft | windows_11_26h1 | - | - | x64 |
| OS | microsoft | windows_11_26h2 | - | - | arm64 |
| OS | microsoft | windows_11_26h2 | - | - | x64 |
| OS | microsoft | windows_server_2012 | r2 | - | - |
| OS | microsoft | windows_server_2016 | - | - | - |
| OS | microsoft | windows_server_2019 | - | - | - |
| OS | microsoft | windows_server_2022 | - | - | - |
| OS | microsoft | windows_server_2025 | - | - | x64 |