Attackers exploit Windows Shell flaw to get around a security feature

What happened

A weakness in Windows Shell lets an attacker without an account get past a Windows security protection over the network. The problem is in how Windows Shell handles certain special characters, which allows command injection. Microsoft titles the issue a Windows Shell Security Feature Bypass Vulnerability.

The attack works remotely and needs no login, but a user has to take some action, such as opening something the attacker supplies. Microsoft published its advisory on 13 October 2026 and reports that the flaw is being exploited. CISA added it to its Known Exploited Vulnerabilities catalog the same day.

Who is affected

Microsoft lists these Windows builds as affected: Windows 10 1607 and Windows Server 2016 before 10.0.14393.9612; Windows 10 1809 and Windows Server 2019 before 10.0.17763.9376; Windows 10 21H2 before 10.0.19044.7807; Windows 10 22H2 before 10.0.19045.7807; Windows 11 23H2 before 10.0.22631.7652; Windows 11 24H2 before 10.0.26100.9711; Windows 11 25H2 before 10.0.26200.9711; Windows 11 26H1 before 10.0.28000.3231; Windows 11 26H2 before 10.0.26300.9711; Windows Server 2022 before 10.0.20348.5761; Windows Server 2025 before 10.0.26100.33650.

Windows Server 2012 R2 and Outlook Web are also listed, without a specific build number.

How serious is it

Microsoft rates the flaw 8.8 out of 10 on the CVSS scale, which counts as high. A successful attack can have a serious effect on the confidentiality, integrity and availability of an affected system.

The flaw is already being used in attacks, which matters more than the score. Whether ransomware groups use it is not known.

What you should do

1. 1Install Microsoft's security update for CVE-2026-96951 on all affected Windows clients and servers.
2. 2Check that each system runs at least the fixed build listed for its Windows version.
3. 3Follow Microsoft's advisory for Windows Server 2012 R2 and Outlook Web, which have no build number listed.
4. 4Note that CISA set 16 October 2026 as the deadline for applying the fix under its directive.

Quick facts