Analyzing CVE-2026-96951: Microsoft Windows Shell Command Injection

A remote command injection vulnerability in the Microsoft Windows Shell, tracked as CVE-2026-96951, allows unauthenticated attackers to execute arbitrary system commands across supported versions of Windows 10 and Windows 11. The flaw stems from improper input neutralization (CWE-77) within the shell component, enabling an adversary to bypass security boundaries over the network once a targeted user interacts with a crafted payload.

Attack Vector and Technical Mechanics

The vulnerability lies in how the Windows Shell processes unvalidated input delivered via external protocols, shortcut handlers, or shell extension parameters. When untrusted parameters containing command separators or shell metacharacters are passed to internal execution routines, the shell fails to properly sanitize the string before invocation.

Because the attack vector is network-based (AV:N) with low attack complexity (AC:L), an attacker can host a malicious link, craft a custom URI scheme handler call, or deliver a tailored document or shortcut file via spear-phishing. The primary constraint on execution is user interaction (UI:R), requiring the target to click a link, open a file preview, or launch an associated protocol. Once triggered, the injected command executes in the security context of the logged-in user, granting full command-line access, code execution, and data exfiltration capabilities (C:H/I:H/A:H).

Assessing Real-World Exposure and EPSS Risk

With a CVSS score of 8.8 (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), the severity of this flaw reflects its wide reach across client workstations and server endpoints running Windows 10 and 11.

The Exploit Prediction Scoring System (EPSS) places the likelihood of wild exploitation in the next 30 days at 1.5%, positioning it in the 74th percentile of monitored vulnerabilities. While a 1.5% score might initially seem low compared to unauthenticated remote code execution bugs in edge gateways, command injection bugs in core desktop components like the Windows Shell routinely become popular initial access vectors for initial access brokers (IABs) and ransomware affiliates. The requirement for user interaction is a low bar in environments where social engineering or web-browsing vectors are unconstrained.

Remediation and Required Triage Actions

System administrators should immediately verify build numbers and apply Microsoft’s updates to bring affected operating systems up to or beyond the following minimum secure builds:

• Windows 10 1607: Build 10.0.14393.9612
• Windows 10 1809: Build 10.0.17763.9376
• Windows 10 21H2: Build 10.0.19044.7807
• Windows 10 22H2: Build 10.0.19045.7807
• Windows 11 23H2: Build 10.0.22631.7652
• Windows 11 24H2: Build 10.0.26100.9711

For federal entities and organizations aligning with CISA’s BOD 26-04 risk-based update directives, the required mitigation compliance deadline is October 16, 2026. Prior to patching internet-facing or high-exposure assets, perform forensic triage on endpoint event logs—specifically checking for unusual process spawning tree events originating from explorer.exe or shell protocol handlers invoking cmd.exe, powershell.exe, or conhost.exe with unexpected command-line arguments.