{"cvss":8.8,"datePublished":"","dateUpdated":"","description":"Affected: Microsoft / Windows version 8.1 and above | Description: Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network. In an email or instant message attack scenario, the attacker could send the targeted user a specially crafted file that is designed to exploit the vulnerability. | Patched since: 2026/10/13 | Exploitation type: unknown | CWEs: CWE-77 | Origin source: CSIRT-IE | Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951","dueDate":"","exploited":true,"id":"CVE-2026-96951","kev_catalogs":["circl"],"knownRansomwareCampaignUse":"","product":"Windows version 8.1 and above","severity":"HIGH","source":"circl_kev","title":"CVE-2026-96951","vendor":"Microsoft"}