Our takeCISA added this actively exploited Windows command injection to the KEV catalog. Patch it.Security Resilience desk
Sources (7)
- cisa_kev · cisa_kev
- cyberscoop · cyberscoop
- govcert_hk · govcert_hk
- govcert_hk · govcert_hk
- govcert_hk · govcert_hk
- govcert_hk · govcert_hk
- govcert_hk · govcert_hk
What this means for you — Security leader:CISA added CVE-2026-96951 (Windows command injection) to the Known Exploited Vulnerabilities catalog. Prioritize and apply the October 2026 Patch Tuesday update per BOD 22-01 and 26-04 risk guidance.
What this means for you — Lean IT orgs:Microsoft released an October security update that fixes an actively exploited Windows command injection bug. Install it on every Windows device you manage as soon as you can.
What this means for you — MSP:CVE-2026-96951 is now in CISA KEV and was fixed in Microsoft’s October 2026 Patch Tuesday release. Ensure all client Windows systems are updated and verify the patch applied correctly.
What this means for you — Researcher:CISA listed CVE-2026-96951 in KEV this month; it is the actively exploited Windows Shell command injection fixed in the October 2026 Patch Tuesday bundle.