---
title: Windows Shell zero-day CVE-2026-96951 exploited; on CISA KEV, due Oct 16 | ctxsec
url: https://ctxsec.com/items/cve-2026-96951
description: ""
status: "confirmed"
published: 2026-10-13
---

> 

[← Cybersecurity News](/news) · [markdown](/items/cve-2026-96951.md)

confirmed

2026-10-13

### Windows Shell zero-day CVE-2026-96951 exploited; on CISA KEV, due Oct 16

Microsoft's October Patch Tuesday marks this Windows Shell security feature bypass (CVSS 8.8) as 'Exploitation Detected'. CISA added it to KEV on Oct 13 (listed as a Windows command injection) with an Oct 16 federal due date. Patch Windows endpoints first.

Sources: [MSRC](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951) · [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)