securitytabs

LiveUpdated

Microsoft October Patch Tuesday fixes exploited Windows Shell flaw CVE-2026-96951

Microsoft says it is aware of exploitation in the wild of a Windows Shell security feature bypass, CVE-2026-96951, patched in October. CISA added it to its Known Exploited Vulnerabilities catalogue the same day.

Written and kept up to date by the SecurityTabs AI newsroom from 3 outlets, and published automatically. Each paragraph cites its sources. CVSS, EPSS and KEV status below come directly from NVD, FIRST and CISA, not from the AI.

Vulnerabilities

What happened

Rapid7 says Microsoft's October 2026 Patch Tuesday covered 1,413 own-product vulnerabilities, including 1,102 in Windows. Rapid7 says Microsoft is aware of exploitation in the wild for just one of the vulnerabilities published that day, a Windows Shell zero-day security feature bypass. [1]

That flaw is CVE-2026-96951, listed in the facts as a Windows Shell Security Feature Bypass Vulnerability with a CVSS score of 8.8. CISA describes it in its KEV announcement as a Microsoft Windows Command Injection Vulnerability. [2][1]

Exploitation

CISA added CVE-2026-96951 to the KEV catalogue on 13 October, citing evidence of active exploitation, alongside an Ivanti Connect Secure flaw, CVE-2026-104935. The sources reviewed do not say who is exploiting the Windows flaw or how widely. The facts list known ransomware use as unknown. [2]

Other critical fixes in the release

Microsoft's release summary highlights four further vulnerabilities: a Windows DHCP Server remote code execution flaw (CVE-2026-96934), a Windows DNS remote code execution flaw (CVE-2026-83869), an Exchange Server spoofing flaw (CVE-2026-70279) and a SQL Server remote code execution flaw (CVE-2026-65674). The facts show CVSS scores of 9.8, 9.8, 9.3 and 8.8 respectively. None is listed in CISA's KEV catalogue. [3]

What to do

Microsoft's summary tells customers to update systems to protect against the newly disclosed vulnerabilities. CISA says KEV-listed vulnerabilities are a frequent attack vector and pose significant risk, and the federal due date for this one was 16 October. [3][2]

Business Action

What this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

Windows machines that have not installed the October 2026 Microsoft updates may be exposed to a Windows Shell flaw that Microsoft and CISA say is exploited. [1][2]

What to do

  1. Install the October 2026 Windows updates on all computers, or ask your IT provider to confirm they are installed. [3]
  2. If an MSP manages your systems, ask whether CVE-2026-96951 has been patched. [2]

Mid-size company

A small IT or security team

What to know

CVE-2026-96951 is a KEV-listed flaw, so it belongs at the front of the patch queue; four other critical Microsoft flaws were fixed in the same release. [2][3]

What to do

  1. Deploy the October 2026 Microsoft security updates, prioritising CVE-2026-96951. [3][2]
  2. Check inventory for Windows DNS, DHCP, Exchange and SQL Server hosts and confirm the matching fixes are installed. [3]

Large enterprise

A security operations team

What to know

Microsoft is aware of exploitation of CVE-2026-96951, and no public attribution or indicators appear in the sources reviewed. The October release is unusually large, according to Rapid7. [1][2]

What to do

  1. Confirm the October 2026 updates are deployed fleet-wide, starting with CVE-2026-96951, and report exceptions. [3][2]
  2. Patch the DNS, DHCP, Exchange and SQL Server servers named in Microsoft's summary. [3]
  3. Watch Microsoft and CISA advisories for indicators or further exploitation details. [2]

Timeline

  1. Microsoft published its October security update summary highlighting CVE-2026-96951 and four other vulnerabilities. [3]

  2. Rapid7 reported that Microsoft's October Patch Tuesday included one vulnerability known to be exploited in the wild, a Windows Shell zero-day. [1]

  3. CISA added CVE-2026-96951 and an Ivanti Connect Secure flaw to its KEV catalogue. [2]

  4. · CISA KEV

    CISA added CVE-2026-96951 to its Known Exploited Vulnerabilities catalog.

  5. · coverage

    Earliest coverage cited in this report: CISA Advisories. [2]

Sources

  1. [1]Rapid7 Blog · Oct 13, 21:40 UTC
    Patch Tuesday - October 2026context
  2. [2]CISA Advisories · Oct 13, 12:00 UTC
    CISA Adds Two Known Exploited Vulnerabilities to Catalogcontext
  3. [3]Microsoft Security · Oct 14, 15:07 UTC
    Security Update Release Summary October 2026context