CVE-2026-96951: high-severity vulnerability in Microsoft Outlook.com
Windows Shell Security Feature Bypass Vulnerability
Published · Updated
Prioritize patching. It under exploitation confirmed by CISA.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
A flaw in Windows Shell allows attackers to inject malicious commands that bypass security protections, potentially giving them unauthorized access over a network. This happens because the system doesn't properly filter out special characters used in commands.
CWE-77 command injection vulnerability in Windows Shell fails to adequately neutralize special elements in user-supplied input, enabling remote attackers to bypass security features through crafted command sequences. The vulnerability requires network access but no authentication, with high impact on confidentiality and integrity of the affected system.
In the same product, most dangerous first.