Windows Shell CVE-2026-96951

Exploitation requires victim user interaction (CVSS UI:R): the target must open or interact with attacker-supplied content (e.g., a crafted file, shortcut, or link) that triggers the Windows Shell security-feature bypass and subsequent command injection. No authentication or prior privileges are needed (PR:N) and the vector is network-reachable (AV:N) with low complexity (AC:L), so no special target configuration is indicated - default Windows Shell behavior is affected. The primary limiting factor is the need for user interaction, which is why SSVC rates the flaw as not automatable; there is no evidence of a non-default configuration requirement.

This is a genuine top-tier priority, not a high-CVSS-but-low-risk case. Multiple independent signals converge: CISA KEV confirms active exploitation in the wild, SSVC rates exploitation as 'active' with 'total' technical impact, a patch is available, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw with full confidentiality, integrity, and availability compromise. The only meaningful brake is UI:R - successful exploitation requires a victim to take an action (e.g., open a crafted file or follow a link) - which is consistent with SSVC marking Automatable='no', so exploitation is user-interaction-gated rather than wormable/mass-automatable. Note a semantic tension worth flagging: the description frames the issue as allowing an attacker to 'bypass a security feature,' yet the CWE is CWE-77 (command injection) and the impact metrics are a full C:H/I:H/A:H triad; the security-feature-bypass framing likely describes the mechanism (evading a Shell protection) that then enables code/command execution - verify exact exploitation primitive against Microsoft's MSRC advisory. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be compared here; however, KEV status makes EPSS moot for prioritization. Treat as emergency-patch class given confirmed active exploitation across virtually all supported Windows releases.

An attacker delivers a crafted file, shortcut, or link to a target and, leveraging a Windows Shell security-feature bypass, causes command injection (CWE-77) when the victim opens or interacts with it. Because this is confirmed actively exploited (CISA KEV) with low attack complexity and no prior privileges, a single user click can yield full compromise of the host. No standalone public POC is identified in the provided data, but in-the-wild exploitation is confirmed.