CVE-2026-96951

Katalog CVE

CVSS 8.8 · High KEV · sudah dieksploitasi

Kerentanan Improper Neutralization of Special Elements used in a Command ('Command Injection') pada Microsoft Windows. Skor CVSS 3.1 8.8 (High) menurut microsoft.com. Masuk katalog KEV CISA pada 13 Oktober 2026, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.

Rincian

Terbit di NVD

13 Oktober 2026

Terakhir diubah

14 Oktober 2026

Status NVD

Undergoing Analysis

CVSS 3.1

8.8 (High), sumber microsoft.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

Known Exploited Vulnerabilities (CISA)

Nama

Microsoft Windows Command Injection Vulnerability

Masuk KEV

13 Oktober 2026

Tenggat CISA

16 Oktober 2026 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Produk dan versi terdampak

> Data produk dari KEV CISA.

Referensi dan perbaikan

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96951