EXPOSURES › CVE-2026-96951
CVE-2026-96951
HIGH ⌖ ON CISA KEV · EXPLOITEDA command injection flaw in Windows Shell lets attackers bypass network security features remotely.
An unauthorized attacker can execute arbitrary commands on a Windows system over a network, bypassing intended security controls. DIB organizations must ensure all Windows endpoints are patched immediately, as this vulnerability is actively exploited in the wild and could lead to lateral movement or data exfiltration. Failure to patch exposes systems to remote code execution and violates CMMC/NIST 800-171 requirements for timely vulnerability management.
Shame score — A fundamental command injection flaw in a core OS component that is actively exploited in the wild, indicating severe negligence in patching and security design.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |