CVE-2026-96951
Outlook Web90/100
confirmed exploited
Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
Listed in CISA KEV and VulnCheck KEV (confirmed exploited in the wild) · EPSS 0.015 (probability of exploitation) · CVSS base 8.8
Public PoC / Exploit
No public PoC/exploit references indexed yet. Newly-disclosed CVEs often have none — exploit publication lags disclosure.
References3
Mentions 3