CriticalCVE-2026-96951

    Azure CLI: Improper Neutralization of Special Elements used in a Command ('Command Injection') (CVE-2026-96951)

    Published In CISA KEV since Sources: BSI

    What is affected, what to do

    Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.

    The vulnerability is being actively exploited; treat it as a priority. Update Microsoft Outlook.com to version 20260925.100, Microsoft Windows 10 Version 1607 to version 10.0.14393.9612, Microsoft Windows 10 Version 1809 to version 10.0.17763.9376. Immediate actions, mitigation and detection rules are in the runbook below.

    Affected
    • Microsoft Outlook.com lt 1.0.0..20260925.100
    • Microsoft Windows 10 Version 1607 lt 10.0.14393.0..10.0.14393.9612
    • Microsoft Windows 10 Version 1809 lt 10.0.17763.0..10.0.17763.9376
    • Microsoft Windows 10 Version 21H2 lt 10.0.19044.0..10.0.19044.7807
    • Microsoft Windows 10 Version 22H2 lt 10.0.19045.0..10.0.19045.7807
    • Microsoft Windows 11 version 23H2 lt 10.0.22631.0..10.0.22631.7652
    • Microsoft Windows 11 Version 24H2 lt 10.0.26100.0..10.0.26100.9711
    • Microsoft Windows 11 Version 25H2 lt 10.0.26200.0..10.0.26200.9711
    • Microsoft Windows 11 version 26H1 lt 10.0.28000.0..10.0.28000.3231
    • Microsoft Windows 11 Version 26H2 lt 10.0.26300.0..10.0.26300.9711
    • Microsoft Windows Server 2012 R2 lt 6.3.9600.0..6.3.9600.23470
    • Microsoft Windows Server 2012 R2 (Server Core installation) lt 6.3.9600.0..6.3.9600.23470
    • Microsoft Windows Server 2016 lt 10.0.14393.0..10.0.14393.9612
    • Microsoft Windows Server 2016 (Server Core installation) lt 10.0.14393.0..10.0.14393.9612
    • Microsoft Windows Server 2019 lt 10.0.17763.0..10.0.17763.9376
    • Microsoft Windows Server 2019 (Server Core installation) lt 10.0.17763.0..10.0.17763.9376
    • Microsoft Windows Server 2022 lt 10.0.20348.0..10.0.20348.5761
    • Microsoft Windows Server 2025 lt 10.0.26100.0..10.0.26100.33650
    • Microsoft Windows Server 2025 (Server Core installation) lt 10.0.26100.0..10.0.26100.33650
    Fixed in
    • Microsoft Outlook.com 20260925.100
    • Microsoft Windows 10 Version 1607 10.0.14393.9612
    • Microsoft Windows 10 Version 1809 10.0.17763.9376
    • Microsoft Windows 10 Version 21H2 10.0.19044.7807
    • Microsoft Windows 10 Version 22H2 10.0.19045.7807
    • Microsoft Windows 11 version 23H2 10.0.22631.7652
    • Microsoft Windows 11 Version 24H2 10.0.26100.9711
    • Microsoft Windows 11 Version 25H2 10.0.26200.9711
    • Microsoft Windows 11 version 26H1 10.0.28000.3231
    • Microsoft Windows 11 Version 26H2 10.0.26300.9711
    • Microsoft Windows Server 2012 R2 6.3.9600.23470
    • Microsoft Windows Server 2012 R2 (Server Core installation) 6.3.9600.23470
    • Microsoft Windows Server 2016 10.0.14393.9612
    • Microsoft Windows Server 2016 (Server Core installation) 10.0.14393.9612
    • Microsoft Windows Server 2019 10.0.17763.9376
    • Microsoft Windows Server 2019 (Server Core installation) 10.0.17763.9376
    • Microsoft Windows Server 2022 10.0.20348.5761
    • Microsoft Windows Server 2025 10.0.26100.33650
    • Microsoft Windows Server 2025 (Server Core installation) 10.0.26100.33650

    Not sure whether and how you are affected? Ask a question about this vulnerability

    Metrics

    8.8

    Priority

    XIEM Effective CVSS: highest available CVSS rating from NVD and vendor data.

    Source: NVD, CVSS v3

    8.8

    CVSS v3

    Severity High on the scale from 0 to 10.

    Source: BSI

    9.8 %

    EPSS score

    Moderate — model estimates 1-10% exploitation likelihood.

    Source: FIRST EPSS, percentile 95.5

    Show all metrics
    Severity
    Critical
    Priority (0–325)

    The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first?

    Read in glossary
    200.53 Methodology
    Exploit maturity

    An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack.

    Read in glossary
    actively exploitedSource: VulnCheck KEV (opens in a new tab), CIRCL Sightings How we classify
    XIEM Effective CVSS

    XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command.

    Read in glossary
    8.8 Methodology
    CVSS v3

    CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions.

    Read in glossary
    8.8
    EPSS score

    The EPSS score is the absolute model output for an individual vulnerability: the estimated probability of real-world exploitation within the next 30 days, expressed as a value between 0 and 1 (i.e. 0 % to 100 %). A score of 0.42 means „the model estimates a 42 % chance of real-world exploitation within 30 days“.

    Read in glossary
    9.8 %
    Moderate — model estimates 1-10% exploitation likelihood.
    EPSS percentile

    The EPSS percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this CVE has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking.

    Read in glossary
    95.5
    Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
    KEV status

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary
    Actively exploited
    Published
    In CISA KEV since

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary
    CISA assessment (SSVC)
    Exploitation: active · not automatable · Technical impact: total
    Source: CISA Vulnrichment, as of 8 October 2026
    CWE

    CWE is a catalogue of typical weakness types in software and hardware — such as flawed input validation, unsafe memory handling or poor authentication. Where a CVE names a concrete vulnerability in a concrete product, a CWE describes the underlying class of defect.

    Read in glossary
    CWE-77

    Response and mitigation

    Why act now?

    Prioritisation rationale

    This flaw is reachable over the network without authentication and only needs a user to open a crafted file or link. That makes it a natural component of phishing and drive-by chains that suppress Mark-of-the-Web or SmartScreen prompts to get a follow-on payload executed. Its statistical exploitation likelihood is moderate rather than top-tier, and CISA reports no known ransomware use. KEV listing nonetheless confirms real-world attacks. Organisations with a large email- and internet-facing workforce should rate it high and fast-track it within the current patch cycle. Isolated OT or kiosk systems without interactive users can follow at lower priority.

    1. Runbook step 1

      Immediate response (0-24 h)

      • Push Microsoft security updates to at least these builds: Windows 10 1607 → 10.0.14393.9612, Windows 10 1809 → 10.0.17763.9376, Windows 10 21H2 → 10.0.19044.7807, Windows 11 23H2 → 10.0.22631.7652, Windows 11 24H2 → 10.0.26100.9711, Windows 11 25H2 → 10.0.26200.9711. KB numbers are not supplied in the context. The patch is available from the vendor, so look up the KB ID in the MSRC advisory for CVE-2026-96951.
      • Windows 10 22H2: the source data is inconsistent. The affected range starts at 10.0.19045.0, but the listed fixed build is 10.0.19044.7807. Confirm the correct target build, likely on the 19045 line, in the MSRC advisory before building compliance queries on it.
      • Query patch state through your inventory tooling (Intune, MECM, Defender Vulnerability Management), e.g. DeviceTvmSoftwareVulnerabilities | where CveId == "CVE-2026-96951". Patch mail- and browser-heavy clients first, then terminal servers and jump hosts.
      • Outlook.com is a service Microsoft has fixed server-side (version 20260925.100). No customer action is needed, but record it for your NIS2 evidence trail.
      • Until rollout completes, send a targeted user advisory: do not open unexpected shortcut, internet-shortcut or archive files from email or downloads. Exploitation requires user interaction.

    2. Runbook step 2

      Mitigation layers

      • Mail/web gateway: Block .lnk, .url, .scf, .library-ms, .searchConnector-ms and .website attachments. Apply the same block to files inside ZIP, ISO, IMG and VHD(X) containers. Quarantine password-protected archives.
      • Network segmentation: Deny outbound SMB (TCP 445/139) and WebDAV to internet destinations at the perimeter. Shell bypass chains commonly fetch payloads via UNC or WebDAV paths. Disable the WebClient service via GPO wherever there is no business need.
      • Endpoint hardening (Defender ASR): Set these rules to Block: "Block executable content from email client and webmail" (BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550), "Block JavaScript or VBScript from launching downloaded executable content" (D3E037E1-B0C8-4C10-A1D5-74A5BB2A3A90) and "Block execution of potentially obfuscated scripts" (5BEB7EFE-FD9A-4556-801D-275E5FFC04CC).
      • Application control: Use WDAC or AppLocker to restrict execution from %USERPROFILE%\Downloads, %TEMP% and mounted ISO volumes. Deny mshta.exe, wscript.exe and cscript.exe to standard users.
      • IAM/least privilege: Remove local admin rights so that a bypassed security feature does not translate straight into host compromise. Restrict privileged accounts to hardened admin workstations without mail or browser access.
      • Configuration: Enforce SmartScreen and Mark-of-the-Web. Ensure the GPO "Do not preserve zone information in file attachments" is set to Disabled so zone information is kept.

    3. Runbook step 3

      Detection rules

      • Sysmon EID 1 / Security EID 4688: Watch for explorer.exe directly spawning cmd.exe, powershell.exe, mshta.exe, rundll32.exe, wscript.exe or conhost.exe --headless with URLs, UNC paths or Base64 in the command line. KQL: DeviceProcessEvents | where InitiatingProcessFileName =~ "explorer.exe" and FileName in~ ("cmd.exe","powershell.exe","mshta.exe","rundll32.exe","wscript.exe") and ProcessCommandLine has_any ("http","\\\\","-enc","FromBase64")
      • Sysmon EID 11 / EID 15: Watch for .lnk or .url files written to Downloads or Temp, especially files dropped by mail or browser processes that have a missing or unusual Zone.Identifier stream. This pattern indicates an MotW bypass.
      • Network telemetry (Zeek/Suricata): Watch for outbound SMB (TCP 445) to external IPs and HTTP PROPFIND/OPTIONS requests with User-Agent Microsoft-WebDAV-MiniRedir. In Zeek http.log, filter on method == "PROPFIND" with an external id.resp_h.
      • SmartScreen/Defender logs: Flag execution of downloaded files with no preceding SmartScreen event (channel Microsoft-Windows-SmartScreen/Debug). Correlate with ASR audit and block events (Defender Event IDs 1121/1122).
      • Sigma shape: logsource: process_creation, ParentImage|endswith: '\explorer.exe', Image|endswith: ['\mshta.exe','\powershell.exe','\cmd.exe'], CommandLine|contains: ['http','\\\\']. Add a filter for legitimate logon scripts.

    Detection rules

    No NEOSEC detection rule is available for this vulnerability yet.

    Classification under NIS2 and CRA

    Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

    NIS2

    NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

    Read in glossary
    Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).
    CRA

    The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

    Read in glossary
    Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.
    ISO/IEC 27001

    ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

    Read in glossary
    Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

    Description

    Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.

    Source: BSI WID Portal

    Affected products

    The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

    Affected products
    Affected versionsFixed in
    MicrosoftAzure CLI
    • 2.0.0 – < 1.0.7
    • 1.0.7
    MicrosoftAzure DevOps CLI Extension
    • 1.0.6 – < 1.0.7
    • 1.0.7
    Microsoftazure-keyvault-administration
    • < 4.7.1
    • 4.7.1 – < 4.8.1
    • 4.7.1 – < 4.8.2
    • 4.7.1
    • 4.8.1
    • 4.8.2
    Microsoftazure-keyvault-certificates
    • < 4.11.2
    • 4.11.2 – < 4.9.1
    • 4.11.2 – < 4.9.2
    • 4.11.2
    • 4.9.1
    • 4.9.2
    Microsoftazure-keyvault-keys
    • 4.11.2 – < 4.10.1
    • 4.11.2 – < 4.10.2
    • < 4.11.2
    • 4.10.1
    • 4.10.2
    • 4.11.2
    Microsoftazure-keyvault-secrets
    • 4.11.2 – < 4.11.1
    • < 4.11.2
    • 4.11.1
    • 4.11.2
    Microsoftazure-keyvault-securitydomain
    • < 1.0.0b3
    • 1.0.0b3
    Microsoftazure_security_keyvault_certificates
    • < 1.0.1
    • 1.0.1
    Microsoftazure_security_keyvault_keys
    • < 1.0.1
    • 1.0.1
    Microsoftazure_security_keyvault_secrets
    • < 1.0.1
    • 1.0.1
    MicrosoftMicrosoft 365 Apps for Enterprise
    • ≥ 16.0.1
    • —
    MicrosoftMicrosoft Office 365 for Mac
    • 1.0.0 – < 16.114.26101123
    • 16.114.26101123
    MicrosoftMicrosoft Office for Android
    • 16.0.1 – < 16.0.20430.20000
    • 16.0.20430.20000
    MicrosoftMicrosoft Office LTSC 2021
    • 16.0.1 – < 16.0.14334.20878
    • 16.0.1 – < 16.0.14334.20974
    • 16.0.14334.20878
    • 16.0.14334.20974
    MicrosoftMicrosoft Office LTSC 2024
    • 16.0.0 – < 16.0.17932.20934
    • 16.0.0 – < 16.0.17932.21056
    • 16.0.17932.20934
    • 16.0.17932.21056
    MicrosoftMicrosoft Office LTSC for Mac 2021
    • 16.0.1 – < 16.114.26101123
    • 16.114.26101123
    MicrosoftMicrosoft Office LTSC for Mac 2024
    • 16.0.0 – < 16.114.26101123
    • 16.114.26101123
    MicrosoftMicrosoft SharePoint Enterprise Server 2016
    • 16.0.0 – < 16.0.5561.1001
    • 16.0.5561.1001
    MicrosoftMicrosoft SharePoint Server 2019
    • 16.0.0 – < 16.0.10417.20175
    • 16.0.10417.20175
    MicrosoftMicrosoft SharePoint Server Subscription Edition
    • 16.0.0 – < 16.0.19725.20434
    • 16.0.0 – < 16.0.20326.20190
    • 16.0.19725.20434
    • 16.0.20326.20190
    MicrosoftOffice Online Server
    • 16.0.0.0 – < 16.0.10417.20228
    • 16.0.10417.20228
    MicrosoftOutlook.com
    • 1.0.0 – < 20260925.100
    • 20260925.100
    MicrosoftSkype for Business Server 2015 CU13
    • 9319.0 – < 6.0.9319.886
    • 6.0.9319.886
    MicrosoftSkype for Business Server 2019 CU8
    • 2046.0 – < 7.0.2046.583
    • 7.0.2046.583
    MicrosoftSkype for Business Server Subscription Edition CU1
    • 2046.0 – < 7.0.2046.889
    • 7.0.2046.889
    MicrosoftWindows 10 Version 1607
    • 10.0.14393.0 – < 10.0.14393.9612
    • 10.0.14393.9612
    MicrosoftWindows 10 Version 1809
    • 10.0.17763.0 – < 10.0.17763.9376
    • 10.0.17763.9376
    MicrosoftWindows 10 Version 21H2
    • 10.0.19044.0 – < 10.0.19044.7807
    • 10.0.19044.7807
    MicrosoftWindows 10 Version 22H2
    • 10.0.19045.0 – < 10.0.19045.7807
    • 10.0.19045.7807
    MicrosoftWindows 11 version 23H2
    • 10.0.22631.0 – < 10.0.22631.7652
    • 10.0.22631.7652
    MicrosoftWindows 11 Version 24H2
    • 10.0.26100.0 – < 10.0.26100.9711
    • 10.0.26100.9711
    MicrosoftWindows 11 Version 25H2
    • 10.0.26200.0 – < 10.0.26200.9711
    • 10.0.26200.9711
    MicrosoftWindows 11 version 26H1
    • 10.0.28000.0 – < 10.0.28000.3231
    • 10.0.28000.3231
    MicrosoftWindows 11 Version 26H2
    • 10.0.26300.0 – < 10.0.26300.9711
    • 10.0.26300.9711
    MicrosoftWindows Server 2012
    • 6.2.9200.0 – < 6.2.9200.26434
    • 6.2.9200.26434
    MicrosoftWindows Server 2012 (Server Core installation)
    • 6.2.9200.0 – < 6.2.9200.26434
    • 6.2.9200.26434
    MicrosoftWindows Server 2012 R2
    • 6.3.9600.0 – < 6.3.9600.23470
    • 6.3.9600.23470
    MicrosoftWindows Server 2012 R2 (Server Core installation)
    • 6.3.9600.0 – < 6.3.9600.23470
    • 6.3.9600.23470
    From bundled advisories, not CVE-specific (1)

    Product list of a bundled advisory that does not state which product this CVE affects.

    Products from bundled advisories
    Affected versionsFixed in
    —Microsoft Windows Shell (and related Oct Patch Tuesday components)
    • Supported Windows versions receiving the October 2026 cumulative updates (see Microsoft Security Update Guide)
    • 2026

    Vendors and products

    Affected operating systems

    Affected operating systems
    Windowsmicrosoftwindows_10_1607—
    Windowsmicrosoftwindows_10_1809—
    Windowsmicrosoftwindows_10_21h2—
    Windowsmicrosoftwindows_10_22h2—
    Windowsmicrosoftwindows_11_23h2—
    Windowsmicrosoftwindows_11_24h2—
    Windowsmicrosoftwindows_11_25h2—
    Windowsmicrosoftwindows_11_26h1—
    Windowsmicrosoftwindows_11_26h2—
    Windowsmicrosoftwindows_server_2012r2
    Windowsmicrosoftwindows_server_2016—
    Windowsmicrosoftwindows_server_2019—
    Windowsmicrosoftwindows_server_2022—
    Windowsmicrosoftwindows_server_2025—

    Weakness classes (CWE)

    • CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')

      Class

      The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

      Entry at MITRE CWE-77

    Public exploit references

    Publicly reported proof-of-concepts, exploit modules and detection templates for this vulnerability. NEOSEC links to the original sources only and does not provide any exploit code.

    Public exploit references
    CISA KEV CatalogCISA Known Exploited Vulnerability (opens in a new tab)cisa.govactively exploited

    References & sources

    Changes to this CVE

    Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

    1. Record modifiedCISA ADP

      CISA assessment (SSVC): exploitation: active, automatable: no

      Show 2 original changes
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      SSVC assessmentremoved
      {"id":"CVE-2026-96951","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-10-15T22:18:16.873555Z"}
      —
      SSVC assessmentadded
      —
      {"id":"CVE-2026-96951","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-10-08T00:00:00+00:00"}

      Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    2. Record modifiedCISA ADP

      CISA assessment (SSVC): exploitation: active, automatable: no

      Show 2 original changes
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      SSVC assessmentremoved
      {"id":"CVE-2026-96951","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-10-08T00:00:00+00:00"}
      —
      SSVC assessmentadded
      —
      {"id":"CVE-2026-96951","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-10-15T22:18:16.873555Z"}

      Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    3. Reanalysis by NVDNVD

      Product mapping changed:
      Show the original change
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      Product configurationchanged
      OR *cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* *cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.20348.5761 *cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.14393.9612 *cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:* versions up to (excluding) 10.0.14393.9612 *cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.17763.9376 *cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:* versions up to (excluding) 10.0.17763.9376 *cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:* versions up to (excluding) 10.0.19044.7807 *cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.19044.7807 *cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x86:* versions up to (excluding) 10.0.19044.7807 *cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:* versions up to (excluding) 10.0.22631.7652 *cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.22631.7652 *cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:* versions up to (excluding) 10.0.26100.9711 *cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.26100.9711 *cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:arm64:* versions up to (excluding) 10.0.26200.9711 *cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.26200.9711 *cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:arm64:* versions up to (excluding) 10.0.28000.3231 *cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.28000.3231 *cpe:2.3:o:microsoft:windows_11_26h2:*:*:*:*:*:*:arm64:* versions up to (excluding) 10.0.26300.9711 *cpe:2.3:o:microsoft:windows_11_26h2:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.26300.9711 *cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.14393.9612 *cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.17763.9376 *cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.26100.33650 *cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:* versions up to (excluding) 10.0.19045.7807 *cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.19045.7807 *cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:* versions up to (excluding) 10.0.19045.7807 *cpe:2.3:a:microsoft:outlook:*:*:*:*:-:windows:*:* versions up to (excluding) 20260925.100
      OR *cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* *cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.20348.5761 *cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.14393.9612 *cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:* versions up to (excluding) 10.0.14393.9612 *cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.17763.9376 *cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:* versions up to (excluding) 10.0.17763.9376 *cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:* versions up to (excluding) 10.0.19044.7807 *cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.19044.7807 *cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x86:* versions up to (excluding) 10.0.19044.7807 *cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:* versions up to (excluding) 10.0.22631.7652 *cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.22631.7652 *cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:* versions up to (excluding) 10.0.26100.9711 *cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.26100.9711 *cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:arm64:* versions up to (excluding) 10.0.26200.9711 *cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.26200.9711 *cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:arm64:* versions up to (excluding) 10.0.28000.3231 *cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.28000.3231 *cpe:2.3:o:microsoft:windows_11_26h2:*:*:*:*:*:*:arm64:* versions up to (excluding) 10.0.26300.9711 *cpe:2.3:o:microsoft:windows_11_26h2:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.26300.9711 *cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.14393.9612 *cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.17763.9376 *cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.26100.33650 *cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:* versions up to (excluding) 10.0.19045.7807 *cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.19045.7807 *cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:* versions up to (excluding) 10.0.19045.7807 *cpe:2.3:a:microsoft:outlook_web:-:*:*:*:*:*:*:*

      Source identifier: nvd@nist.gov

    4. Initial analysis by NVDNVD

      Newly listed as affected:
      Show 3 original changes
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      Product configurationadded
      —
      OR *cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* *cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.20348.5761 *cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.14393.9612 *cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:* versions up to (excluding) 10.0.14393.9612 *cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.17763.9376 *cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:* versions up to (excluding) 10.0.17763.9376 *cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:* versions up to (excluding) 10.0.19044.7807 *cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.19044.7807 *cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x86:* versions up to (excluding) 10.0.19044.7807 *cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:* versions up to (excluding) 10.0.22631.7652 *cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.22631.7652 *cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:* versions up to (excluding) 10.0.26100.9711 *cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.26100.9711 *cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:arm64:* versions up to (excluding) 10.0.26200.9711 *cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.26200.9711 *cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:arm64:* versions up to (excluding) 10.0.28000.3231 *cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.28000.3231 *cpe:2.3:o:microsoft:windows_11_26h2:*:*:*:*:*:*:arm64:* versions up to (excluding) 10.0.26300.9711 *cpe:2.3:o:microsoft:windows_11_26h2:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.26300.9711 *cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.14393.9612 *cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.17763.9376 *cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.26100.33650 *cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:* versions up to (excluding) 10.0.19045.7807 *cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.19045.7807 *cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:* versions up to (excluding) 10.0.19045.7807 *cpe:2.3:a:microsoft:outlook:*:*:*:*:-:windows:*:* versions up to (excluding) 20260925.100
      Reference typeadded
      —
      Microsoft Corporation: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951 Types: Patch, Vendor Advisory
      Reference typeadded
      —
      CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96951 Types: US Government Resource

      Source identifier: nvd@nist.gov

    5. Record modifiedCISA ADP

      CISA assessment (SSVC): exploitation: none known, automatable: no

      Show 2 original changes
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      SSVC assessmentremoved
      {"id":"CVE-2026-96951","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-10-13T19:40:04.830018Z"}
      —
      SSVC assessmentadded
      —
      {"id":"CVE-2026-96951","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-10-08T00:00:00+00:00"}

      Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Show 3 older changes

    1. CISA KEV entry updated9119a7d8…

      4 individual changes: Date Added, Due Date, Required Action, Vulnerability Name

      Show 4 original changes
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      Date Addedadded
      —
      2026-10-13
      Due Dateadded
      —
      2026-10-13
      Required Actionadded
      —
      2026-10-13
      Vulnerability Nameadded
      —
      2026-10-13

      Source identifier: 9119a7d8-5eab-497f-8521-727c672e3725

    2. Record modifiedCISA ADP

      CISA assessment (SSVC): exploitation: active, automatable: no

      Show 2 original changes
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      Referenceadded
      —
      https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96951
      SSVC assessmentadded
      —
      {"id":"CVE-2026-96951","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-10-13T19:40:04.830018Z"}

      Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    3. ReceivedMicrosoft

      CVSS V3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

      Weakness type: CWE-77

      Description added or changed

      Show 5 original changes
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      Descriptionadded
      —
      Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
      CVSSadded
      —
      AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
      Weakness type (CWE)added
      —
      CWE-77
      Affected versions (publisher)added
      —
      New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/96xxx/CVE-2026-96951.json">CVE-2026-96951</a>
      Referenceadded
      —
      https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951

      Source identifier: secure@microsoft.com

    Linked CVEs

    Linked CVEs
    HighCVE-2026-97783Microsoft Office SharePoint Spoofing Vulnerability8.1—
    MediumCVE-2026-97782Microsoft Office SharePoint Tampering Vulnerability6.8—
    HighCVE-2026-97781Microsoft Office OneNote Remote Code Execution Vulnerability8.8—
    HighCVE-2026-97780Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    MediumCVE-2026-97779Microsoft Office Excel Information Disclosure Vulnerability6.5—
    HighCVE-2026-97778Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    HighCVE-2026-97777Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    HighCVE-2026-97776Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    HighCVE-2026-97775Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    HighCVE-2026-97774Microsoft Office Click-To-Run Elevation of Privilege Vulnerability7.0—
    HighCVE-2026-97773Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    HighCVE-2026-97772Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    HighCVE-2026-97771Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    HighCVE-2026-97770Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    HighCVE-2026-97769Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    HighCVE-2026-97768Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    HighCVE-2026-97767Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    HighCVE-2026-97766Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    HighCVE-2026-97765Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    HighCVE-2026-97763Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    HighCVE-2026-97762Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    HighCVE-2026-97761Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    MediumCVE-2026-97760Microsoft Office Excel Information Disclosure Vulnerability6.5—
    HighCVE-2026-97759Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    Show 157 more CVEs
    Linked CVEs
    HighCVE-2026-97758Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    HighCVE-2026-97757Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    HighCVE-2026-97756Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    HighCVE-2026-97755Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    HighCVE-2026-97754Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    HighCVE-2026-97753Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    HighCVE-2026-97752Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    HighCVE-2026-97751Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    HighCVE-2026-97750Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    CriticalCVE-2026-97749Microsoft Office Outlook Remote Code Execution Vulnerability9.8—
    HighCVE-2026-97748Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    HighCVE-2026-97747Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    HighCVE-2026-97746Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    HighCVE-2026-97745Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    MediumCVE-2026-97744Microsoft Office PowerPoint Information Disclosure Vulnerability5.5—
    MediumCVE-2026-97743Microsoft Office Excel Information Disclosure Vulnerability6.5—
    HighCVE-2026-97742Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    HighCVE-2026-97741Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    MediumCVE-2026-97740Microsoft Office Excel Information Disclosure Vulnerability6.5—
    HighCVE-2026-97739Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    HighCVE-2026-97738Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    HighCVE-2026-97017Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    CriticalCVE-2026-97016Microsoft Office Outlook Remote Code Execution Vulnerability9.8—
    MediumCVE-2026-97014Microsoft Office Excel Information Disclosure Vulnerability5.5—
    HighCVE-2026-97012Microsoft Office Outlook Remote Code Execution Vulnerability8.8—
    HighCVE-2026-97011Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    HighCVE-2026-97010Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    HighCVE-2026-97009Microsoft Office Excel Remote Code Execution Vulnerability7.8—
    HighCVE-2026-97008Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    HighCVE-2026-97007Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    MediumCVE-2026-97005Microsoft Office PowerPoint Information Disclosure Vulnerability5.5—
    HighCVE-2026-97004Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    HighCVE-2026-97003Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    HighCVE-2026-97001Microsoft Office Word Remote Code Execution Vulnerability7.8—
    HighCVE-2026-96997Microsoft Office OneNote Elevation of Privilege Vulnerability7.8—
    HighCVE-2026-96996Microsoft Office Word Remote Code Execution Vulnerability7.8—
    HighCVE-2026-96995Microsoft Office Word Elevation of Privilege Vulnerability7.8—
    CriticalCVE-2026-96951Windows Shell Security Feature Bypass Vulnerability8.8Actively exploited
    HighCVE-2026-96044Microsoft Office SharePoint Elevation of Privilege Vulnerability8.8—
    MediumCVE-2026-94506Microsoft Office Access Information Disclosure Vulnerability6.5—
    HighCVE-2026-88210Microsoft Office Word Security Feature Bypass Vulnerability7.8—
    MediumCVE-2026-88209Microsoft Office SharePoint Spoofing Vulnerability4.6—
    MediumCVE-2026-88208Microsoft Office SharePoint Spoofing Vulnerability4.6—
    HighCVE-2026-88207Microsoft Office PowerPoint Remote Code Execution Vulnerability7.5—
    HighCVE-2026-88206Microsoft Office SharePoint Elevation of Privilege Vulnerability7.5—
    HighCVE-2026-88204Microsoft Office SharePoint Spoofing Vulnerability7.3—
    MediumCVE-2026-88203Microsoft Office PowerPoint Information Disclosure Vulnerability6.5—
    HighCVE-2026-88202Microsoft Office Word Remote Code Execution Vulnerability8.8—
    MediumCVE-2026-88201Microsoft Office Excel Information Disclosure Vulnerability6.5—
    HighCVE-2026-88200Microsoft Office SharePoint Elevation of Privilege Vulnerability8.8—
    HighCVE-2026-88198Microsoft Office SharePoint Elevation of Privilege Vulnerability8.8—
    HighCVE-2026-88197Microsoft Office Remote Code Execution Vulnerability8.8—
    HighCVE-2026-88196Microsoft Office Remote Code Execution Vulnerability8.8—
    MediumCVE-2026-88195Microsoft Office Excel Information Disclosure Vulnerability6.5—
    MediumCVE-2026-88192Microsoft Office Excel Information Disclosure Vulnerability6.5—
    MediumCVE-2026-88190Microsoft Office Excel Information Disclosure Vulnerability6.5—
    HighCVE-2026-88186Microsoft Office Word Remote Code Execution Vulnerability8.8—
    HighCVE-2026-88185Microsoft Office Word Remote Code Execution Vulnerability8.1—
    MediumCVE-2026-88184Microsoft Office Excel Information Disclosure Vulnerability6.5—
    MediumCVE-2026-88183Microsoft Office PowerPoint Information Disclosure Vulnerability6.5—
    CriticalCVE-2026-88178Microsoft Office PowerPoint Remote Code Execution Vulnerability9.8—
    MediumCVE-2026-88175Microsoft Office Excel Information Disclosure Vulnerability6.5—
    MediumCVE-2026-88172Microsoft Office Excel Information Disclosure Vulnerability6.5—
    MediumCVE-2026-88169Microsoft Office Word Information Disclosure Vulnerability6.5—
    MediumCVE-2026-88167Microsoft Office Word Information Disclosure Vulnerability6.5—
    HighCVE-2026-88166Microsoft Office SharePoint Remote Code Execution Vulnerability8.8—
    HighCVE-2026-88163Microsoft Office SharePoint Remote Code Execution Vulnerability8.8—
    CriticalCVE-2026-88156Microsoft Office Outlook Remote Code Execution Vulnerability9.8—
    HighCVE-2026-88155Microsoft Office SharePoint Remote Code Execution Vulnerability8.8—
    MediumCVE-2026-88154Microsoft Office Excel Information Disclosure Vulnerability6.5—
    MediumCVE-2026-88153Microsoft Office Excel Information Disclosure Vulnerability6.5—
    MediumCVE-2026-88151Microsoft Office Excel Information Disclosure Vulnerability6.5—
    HighCVE-2026-88150Microsoft Office Word Remote Code Execution Vulnerability8.8—
    HighCVE-2026-88145Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    HighCVE-2026-88144Microsoft Office PowerPoint Remote Code Execution Vulnerability8.8—
    MediumCVE-2026-88132Azure Key Vault Information Disclosure Vulnerability5.9—
    HighCVE-2026-88109Microsoft Office Click-To-Run Elevation of Privilege Vulnerability7.8—
    MediumCVE-2026-85932Microsoft Office SharePoint Information Disclosure Vulnerability6.5—
    HighCVE-2026-85925Azure Key Vault Client SDK Elevation of Privilege Vulnerability8.2—
    HighCVE-2026-85922Azure Key Vault Security Feature Bypass Vulnerability7.4—
    HighCVE-2026-85900Microsoft Office SharePoint Remote Code Execution Vulnerability8.8—
    HighCVE-2026-85881Microsoft Office Graphics Elevation of Privilege Vulnerability8.0—
    MediumCVE-2026-85873Skype for Business Elevation of Privilege Vulnerability6.5—
    HighCVE-2026-85340Microsoft Office Click-To-Run Elevation of Privilege Vulnerability7.8—
    HighCVE-2026-83891Microsoft Office Word Remote Code Execution Vulnerability8.8—
    HighCVE-2026-83746Skype for Business Elevation of Privilege Vulnerability8.1—
    HighCVE-2026-77902Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    HighCVE-2026-70302Microsoft Office Word Remote Code Execution Vulnerability8.8—
    HighCVE-2026-70301Microsoft Office Word Remote Code Execution Vulnerability8.8—
    CriticalCVE-2026-70300Microsoft Office Word Remote Code Execution Vulnerability9.8—
    MediumCVE-2026-70298Microsoft Office SharePoint Information Disclosure Vulnerability6.5—
    HighCVE-2026-70297Skype for Business Remote Code Execution Vulnerability8.8—
    CriticalCVE-2026-70291Microsoft Office Outlook Remote Code Execution Vulnerability9.8—
    HighCVE-2026-70287Microsoft Office Word Remote Code Execution Vulnerability8.8—
    HighCVE-2026-70282Microsoft Office Outlook Remote Code Execution Vulnerability8.8—
    HighCVE-2026-70281Microsoft Office Outlook Information Disclosure Vulnerability7.5—
    HighCVE-2026-70276Microsoft Office Click-To-Run Elevation of Privilege Vulnerability7.0—
    HighCVE-2026-70269Microsoft Office Word Remote Code Execution Vulnerability8.1—
    HighCVE-2026-70268Microsoft Office Word Remote Code Execution Vulnerability8.8—
    HighCVE-2026-70267Microsoft Office SharePoint Remote Code Execution Vulnerability7.2—
    HighCVE-2026-70266Microsoft Office SharePoint Elevation of Privilege Vulnerability8.8—
    MediumCVE-2026-70263Microsoft Office Word Information Disclosure Vulnerability6.5—
    MediumCVE-2026-70259Microsoft Office SharePoint Information Disclosure Vulnerability6.5—
    HighCVE-2026-70257Microsoft Office Outlook Remote Code Execution Vulnerability8.8—
    HighCVE-2026-70256Microsoft Office Outlook Remote Code Execution Vulnerability8.8—
    HighCVE-2026-70254Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    HighCVE-2026-70251Microsoft Office SharePoint Elevation of Privilege Vulnerability7.5—
    HighCVE-2026-70246Microsoft Office SharePoint Elevation of Privilege Vulnerability8.8—
    CriticalCVE-2026-70242Microsoft Office Outlook Remote Code Execution Vulnerability9.8—
    HighCVE-2026-70220Microsoft Office Word Remote Code Execution Vulnerability7.8—
    MediumCVE-2026-70219Microsoft Office Excel Information Disclosure Vulnerability6.5—
    MediumCVE-2026-70217Microsoft Office SharePoint Information Disclosure Vulnerability4.9—
    HighCVE-2026-70215Microsoft Office PowerPoint Remote Code Execution Vulnerability8.8—
    MediumCVE-2026-70214Microsoft Office Excel Information Disclosure Vulnerability5.5—
    MediumCVE-2026-70206Microsoft Office Word Information Disclosure Vulnerability6.5—
    HighCVE-2026-70202Microsoft Office SharePoint Elevation of Privilege Vulnerability7.5—
    CriticalCVE-2026-70096Windows Rich Text Edit Control Remote Code Execution Vulnerability9.8—
    HighCVE-2026-69943Microsoft Office SharePoint Remote Code Execution Vulnerability8.8—
    MediumCVE-2026-69922Microsoft Office Excel Information Disclosure Vulnerability6.5—
    MediumCVE-2026-69877Azure DevOps Information Disclosure Vulnerability6.5—
    MediumCVE-2026-105731Microsoft Office Graphics Component Information Disclosure Vulnerability5.5—
    MediumCVE-2026-105720Microsoft Office SharePoint Elevation of Privilege Vulnerability4.3—
    MediumCVE-2026-105719Microsoft SharePoint Server Information Disclosure Vulnerability6.5—
    HighCVE-2026-105718Microsoft Excel Remote Code Execution Vulnerability8.8—
    HighCVE-2026-105717Microsoft Office Access Remote Code Execution Vulnerability8.8—
    HighCVE-2026-105716Microsoft Office Access Remote Code Execution Vulnerability8.8—
    HighCVE-2026-105715Microsoft Office Word Remote Code Execution Vulnerability7.5—
    HighCVE-2026-105714Microsoft Office Access Remote Code Execution Vulnerability7.5—
    MediumCVE-2026-105713Microsoft Office SharePoint Spoofing Vulnerability5.7—
    HighCVE-2026-105599Microsoft Office PowerPoint Remote Code Execution Vulnerability7.5—
    HighCVE-2026-105598Microsoft Office Access Remote Code Execution Vulnerability8.8—
    HighCVE-2026-105597Microsoft Office Access Remote Code Execution Vulnerability8.8—
    HighCVE-2026-105596Microsoft Office Access Remote Code Execution Vulnerability8.8—
    HighCVE-2026-105595Microsoft Office Access Remote Code Execution Vulnerability8.8—
    HighCVE-2026-105593Microsoft Office Access Remote Code Execution Vulnerability8.8—
    HighCVE-2026-105592Microsoft Office Access Remote Code Execution Vulnerability7.5—
    HighCVE-2026-105591Microsoft Office Access Remote Code Execution Vulnerability8.8—
    HighCVE-2026-105013Microsoft Office SharePoint Remote Code Execution Vulnerability7.4—
    MediumCVE-2026-102867Microsoft Office Word Information Disclosure Vulnerability6.5—
    HighCVE-2026-102866Microsoft Office SharePoint Elevation of Privilege Vulnerability8.1—
    MediumCVE-2026-102865Microsoft Office SharePoint Information Disclosure Vulnerability6.5—
    MediumCVE-2026-102864Microsoft Office SharePoint Spoofing Vulnerability4.6—
    HighCVE-2026-102863Microsoft Office SharePoint Elevation of Privilege Vulnerability8.8—
    HighCVE-2026-102862Microsoft Office SharePoint Elevation of Privilege Vulnerability8.8—
    HighCVE-2026-102861Microsoft Office SharePoint Elevation of Privilege Vulnerability8.8—
    HighCVE-2026-102860Microsoft Office SharePoint Elevation of Privilege Vulnerability8.8—
    MediumCVE-2026-102859Microsoft Office SharePoint Spoofing Vulnerability4.6—
    HighCVE-2026-102858Microsoft Office OneNote Remote Code Execution Vulnerability8.8—
    HighCVE-2026-102857Microsoft Office Visio Remote Code Execution Vulnerability8.8—
    HighCVE-2026-102856Microsoft Office Visio Remote Code Execution Vulnerability8.8—
    HighCVE-2026-102855Microsoft Office Visio Remote Code Execution Vulnerability8.8—
    HighCVE-2026-102850Microsoft Office Access Remote Code Execution Vulnerability8.8—
    HighCVE-2026-102849Microsoft Office Access Remote Code Execution Vulnerability8.8—
    HighCVE-2026-100212Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    HighCVE-2026-100211Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    HighCVE-2026-100210Microsoft Office Excel Remote Code Execution Vulnerability8.8—
    HighCVE-2026-100209Microsoft Office Excel Remote Code Execution Vulnerability8.8—

    Linked advisories

    Embed badge

    Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.

    Badge preview for CVE-2026-96951
    <a href="https://intel.neosec.eu/en/cve/CVE-2026-96951"><img src="https://intel.neosec.eu/badge/cve/CVE-2026-96951.svg?lang=en" alt="CVE-2026-96951 – NEOSEC Intel" height="20"></a>