CISA orders federal agencies to patch critical Windows Shell vulnerability
The Cybersecurity and Infrastructure Security Agency has ordered federal agencies to patch an actively exploited Windows Shell zero-day vulnerability by November 4, 2026.
FTMQ Security, written by our newsroom1 view
The Cybersecurity and Infrastructure Security Agency added an actively exploited Windows Shell zero-day vulnerability to its Known Exploited Vulnerabilities catalog on October 15, 2026, homeland411.com reported. The agency ordered all federal civilian agencies to apply emergency security patches across their enterprise systems before November 4, 2026. [1]
Microsoft Corporation confirmed the flaw carries a Common Vulnerability Scoring System rating of 8.8, according to homeland411.com. The publication described the flaw, tracked as CVE-2026-96951, as a high-severity command injection defect within the core Windows Shell architecture. The vulnerability enables remote attackers to bypass Mark of the Web security controls. [1]
As FTMQ Security reported earlier, Microsoft released a patch for the zero-day flaw during its October 2026 Patch Tuesday update. The issue affects Windows 10, Windows 11, and Windows Server systems, and allows unauthenticated attackers to bypass security protections. [4][5]
The Cybersecurity and Infrastructure Security Agency is a component of the United States Department of Homeland Security responsible for cybersecurity and infrastructure protection, with headquarters in Arlington, Virginia. [2]
In short
- CISA added CVE-2026-96951 to its Known Exploited Vulnerabilities catalog.
- Federal civilian agencies must patch the Windows Shell vulnerability before November 4, 2026.
- CVE-2026-96951 carries a CVSS severity score of 8.8.
- The vulnerability allows attackers to bypass Mark of the Web protections on Windows systems.
Sources
Every paragraph above points to the numbered items it rests on. Read the originals here.
- [1]CISA Issues Federal Directive on Windows Shell Zero-Day CVE-2026-96951 Following Active Exploitationhomeland411.com, 1d ago (the report this story comes from)
Background
- [2]Cybersecurity and Infrastructure Security Agency on Wikipedia
- [3]Active Exploits on Wikipedia
- [4]Microsoft patches actively exploited Windows Shell zero day vulnerability FTMQ Security, 3d ago
- [5]Microsoft releases updates for more than 1400 security vulnerabilities FTMQ Security, 5d ago
Our newsroom writes these reports with the help of software, from the 5 sources listed and nothing else, and checks them against those sources. Facts can still be wrong or move on; the originals are the record. Spotted a mistake? Write to daniel@monsterkong.com.
More in Bugs and Patches
- Critical Nextcloud Collabora app flaw exploited to plant web shells6h ago
- Microsoft patches actively exploited Windows Shell zero day vulnerability3d ago
- Hackers chain Ivanti zero days to gain remote root access4d ago
- Citrix releases critical security patch for NetScaler ADC and Gateway9d ago
- Citrix issues emergency patch for critical NetScaler vulnerability9d ago
- Proof of concept exploit released for critical VMware VMXNET3 security flaw10d ago
Get the day in one email
Reports like this one, the top news of the last 24 hours, every morning. Free, one email a day; readers can comment under every report.
By signing up you agree to our terms and privacy policy. Unsubscribe any time.
Comments
Loading
Join the conversation
Comments are open to readers of our daily email: the top news of the last 24 hours, every morning, free. Sign up and the comment box opens.
Already on the list? Enter the same address and we will send a sign-in link.
By signing up you agree to our terms and privacy policy. Unsubscribe any time.