Microsoft Windows command-injection bug added to CISA's exploited list
On October 13, 2026, CISA added CVE-2026-96951, a command-injection vulnerability in Microsoft Windows, to the Known Exploited Vulnerabilities catalog because of evidence it was being exploited.
What was reported
CISA's October 13, 2026 alert lists CVE-2026-96951 as "Microsoft Windows Command Injection Vulnerability" and says it was added to the catalog based on evidence of active exploitation. The alert does not name a build number or a KB article. This note does not invent one.
The same alert also lists the Ivanti Connect Secure bug CVE-2026-104935, which has its own item in this feed. They are separate products that CISA published on the same day.
How to prevent it
Install Microsoft's update that covers CVE-2026-96951 on Windows machines you administer. A listing in the Known Exploited Vulnerabilities catalog means the bug is already being used, so this is not a change to leave for the next monthly window if those machines are in reach of an attacker.
Sources
The weekly fix
The weekly fix: 3 real security mistakes in vibe-coded apps and how to fix them, every Tuesday.