Actively exploited in the wild
Microsoft Windows Command Injection Vulnerability
Microsoft - Windows · Listed in the CISA KEV since 2026-10-13. This indicates confirmed attacks in production environments.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-96951
HighCVSS 8.8KEVSummary
Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
Risk Assessment
An attacker could bypass Windows security features without authentication, potentially leading to unauthorized actions within the organization's environment.
Recommendation
Immediately apply available security updates for Windows Shell and limit network exposure of shell-related services.
Other vulnerabilities in Windows Shell
See all- CVE-2017-8699High
Windows Shell in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to run arbitrary code in the context of the current user due to improper validation of file copy destinations.
- CVE-2017-8463High
Windows Shell in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 has a remote code execution vulnerability due to improper handling of executable files and shares during rename operations.
- CVE-2016-0179High
Windows Shell in Microsoft Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted web site.
- CVE-2015-2515High
A use-after-free vulnerability in Windows Shell in various versions of Microsoft Windows allows remote attackers to execute arbitrary code via a crafted toolbar object.
- CVE-2026-83782Critical
Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to execute code over a network.
- CVE-2026-69829Critical
Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to execute code remotely over a network.
- CVE-2026-32202MediumActively exploited
A protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network. This could lead to impersonation of trusted entities.
- CVE-2018-8414HighActively exploited
A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths. This affects Windows 10 Servers, Windows 10.
- CVE-2026-70563High
Improper link resolution before file access ('link following') in Windows Shell allows an unauthorized attacker to perform spoofing over a network.
- CVE-2026-69606High
Use after free in Windows Shell allows an authorized attacker to elevate privileges locally.
Original NVD description (English source)
Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS