{"id":"CVE-2026-96951","published":"2026-10-13T19:22:07.760","lastModified":"2026-10-16T17:18:00.760","description":"Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-77"],"vendors":["microsoft"],"products":["outlook web","windows 10 1607","windows 10 1809","windows 10 21h2","windows 10 22h2","windows 11 23h2","windows 11 24h2","windows 11 25h2","windows 11 26h1","windows 11 26h2","windows server 2012","windows server 2016"],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96951","tags":["US Government Resource"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows attackers to inject malicious commands through Windows Shell, potentially bypassing security features and gaining full system access. The flaw exists in Outlook Web's command execution handling.","exploitability":"Exploitation requires a network-based attack with user interaction, as the vulnerability triggers through web-based Outlook components with no preconditions for exploitation.","blast_radius":"If exploited, this could allow attackers to execute arbitrary commands on affected Windows systems, potentially leading to complete system compromise across multiple Windows versions including Windows 10 and 11.","remediation":"Deploy the Microsoft security update KB5042879 for Windows 10 version 1607, Windows 10 version 1809, Windows 10 version 21H2, Windows 10 version 22H2, Windows 11 version 23H2, and Windows 11 version 24H2.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["command-injection","windows-shell","web"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:18:52.566Z"}}