Demo — ChangeSignal

CVE-2026-96951

Microsoft Windows Command Injection Vulnerability

1 CVE · 1 exploited · 1 not version-checked · 1 finding filed under this action, at any date

Sources

CISA Known Exploited Vulnerabilities Catalog governmentCVE-2026-96951 ↗ msrc.microsoft.com

Affected

Windows

CISA KEV required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CISA’s own words, verbatim from the KEV record · CVE-2026-96951 ↗

CVEs and records 1

Severity is the source’s own; CVSS only where the record states it. Open a record for its evidence.

CVE-2026-96951exploitedMicrosoft Windows Command Injection VulnerabilitySeverity —CVSS —Published 2026-10-13↗
Microsoft Windows Command Injection Vulnerability product match, version not evaluated
CISA KEV lists "Microsoft - Windows" (KEV does not separate Windows client from Server.). Version not evaluated: the source published no machine-readable affected-version data. Known exploited in the wild and affects a technology you run, but we could not confirm your specific version. Capped below Critical because the version match is unconfirmed.
⚠ We could not compare your version for this item. It is shown because the product matches, and it is never scored Critical on that basis alone.
Source
CISA Known Exploited Vulnerabilities Catalog (government)
Record
CVE-2026-96951
CVE
CVE-2026-96951
Published
2026-10-13
Severity
unknown · known exploited
Reported against
Windows
Your version
10.0.20348.5622
Source’s own remediation: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.