← Global Threat Landscape
CVE-2026-96951
CWE-77
Final Priority
High86.2
Raw RPSRPS range: 0–105; KEV-listed vulnerabilities can receive an exploitation amplifier.
Description
Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
Source: NVD
Signals
- CVSS
- 8.8
- High · v3.1
- EPSS
- 1.51%
- Probability of exploitation in the next 30 days (FIRST) · Percentile: 74.2%
- CISA KEV
- In CISA KEV since Oct 2026
- Confirmed exploitation in the wild (CISA KEV)
- Upstream fix commit
- No verified fix commit in DevSecure data
- Sources: MoreFixes, FreshFixes
- SSVC inputs (CISA)
- Exploitation: Active · Automatable: No · Technical impact: Total
- CISA's assessed SSVC inputs, not a decision. A decision also needs your mission and public well-being context. Context only; not part of the RPS score.
- Weakness
- CWE-77
- Published
- 13 Oct 2026
- Last modified 16 Oct 2026
How to read these signals: RPS · EPSS · CISA KEV · Data sources
What would change this priority?
- ↑Would become Critical if the EPSS percentile reaches 82.7%, raising the raw RPS to 90 or more.
- •Stays at least High while it is in CISA KEV (KEV floor).
Explains the published RPS formula and priority rules; it doesn't change the score. How priority works
Get this score from the API
curl -H "Authorization: Bearer dsec_live_xxxxxxxx" \
https://api.intelligence.devsecure.io/api/v1/rps/CVE-2026-96951Replace the placeholder with your key. Get a free API key or rank your own CVEs.
Data as of 23 Oct 2026, 05:17 UK time
This product uses the NVD API but is not endorsed or certified by the NVD. Data sources and licences