Our automated tracking framework flagged that CISA added CVE-2026-96951 (Microsoft Windows) to the Known Exploited Vulnerabilities (KEV) catalog on October 14, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild — U.S. federal agencies must patch it by a fixed deadline. Here is what our data shows.
What CISA Reported
CISA describes the flaw as follows: “Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.”
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-96951 by October 16, 2026 — a 3-day window. Private organizations are not bound by the deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
The Details
| CVE | CVE-2026-96951 |
| Vendor / product | Microsoft Windows |
| Vulnerability | Microsoft Windows Command Injection Vulnerability |
| CVSS base score | 8.8 |
| Added to KEV | October 13, 2026 |
| Days public before listing (NVD → KEV lag) | 0 |
| Federal patch deadline | October 16, 2026 |
| Known ransomware use | No |
How This Compares to Microsoft’s Track Record
This one was listed on or before its public disclosure (a lag of 0 days) — a zero-day exploited at or before the vulnerability was even published. Microsoft currently ranks #20 on our KEV Lag leaderboard.
| Microsoft in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 390 |
| Median lag (public → KEV listing) | 522 days |
| 0-day rate (exploited at or before disclosure) | 23% |
| Entries tied to known ransomware campaigns | 104 |
For perspective, the median across all 1741 tracked KEV entries is 245 days — Microsoft’s exploited vulnerabilities are flagged slower than the catalog average.
Other Recent Microsoft KEV Additions
The most recent Microsoft vulnerabilities CISA has confirmed as actively exploited, from our tracker:
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2026-65660 | SharePoint | September 25, 2026 | 45 | No |
| CVE-2026-81963 | Windows | September 8, 2026 | 0 | No |
| CVE-2026-85880 | Windows | September 8, 2026 | 0 | No |
| CVE-2019-1068 | SQL Server | August 26, 2026 | 2599 | No |
| CVE-2026-55040 | SharePoint | August 18, 2026 | 35 | No |
Defense guide: How to Detect Zero-day Vulnerability: Attack Chain & Defense — detection signals, attack chain and response steps for this class of attack.
What This Means for Defenders
CISA added CVE-2026-96951, a Microsoft Windows vulnerability with a CVSS base score of 8.8, to its KEV catalog on October 13, 2026. Federal agencies must patch by October 16, 2026. This CVE was listed in KEV on the same day it became public (0-day lag), signaling its critical urgency for all organizations.
Its rapid inclusion in the KEV catalog suggests exploitation began very quickly after – or even before – public disclosure, leaving no detection window. This 0-day lag is unusually swift for a KEV entry, indicating a high-impact exploitation campaign. All organizations using Microsoft Windows are exposed and should prioritize patching immediately.
If you cannot patch before the federal deadline, implement compensating controls. This could involve network segmentation to restrict access to vulnerable systems, applying strict endpoint detection and response (EDR) policies, enhancing monitoring for unusual command execution patterns, and bolstering least-privilege access controls to limit potential damage from successful exploitation. Pay particular attention to inputs and process execution integrity.
Related Coverage
- Critical Microsoft SharePoint Flaw CVE-2026-50522 (CVSS 9.8) Added to CISA KEV (July 2026)
- Microsoft’s CVE-2026-68820 Was Exploited in 0 Days — Well Under Its 567-Day Median (August 2026)
How We Track This
This report was generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No dates or figures on this page are estimated or taken from third-party sources — they come directly from CISA and NVD records.
