Command Injection Vulnerability
Exploited in the wild. CISA added it to its Known Exploited Vulnerabilities list on 13 Oct 2026.
9.8%
Reading the vendor advisory
Fix it in your code
Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-96951. Nothing runs until you send it.
Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
You are affected if
The fix