CVE-2026-96951

Summary

This vulnerability allows attackers to inject malicious commands through Windows Shell, potentially bypassing security features and gaining full system access. The flaw exists in Outlook Web's command execution handling.

Exploitability

Exploitation requires a network-based attack with user interaction, as the vulnerability triggers through web-based Outlook components with no preconditions for exploitation.

Blast radius

If exploited, this could allow attackers to execute arbitrary commands on affected Windows systems, potentially leading to complete system compromise across multiple Windows versions including Windows 10 and 11.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Deploy the Microsoft security update KB5042879 for Windows 10 version 1607, Windows 10 version 1809, Windows 10 version 21H2, Windows 10 version 22H2, Windows 11 version 23H2, and Windows 11 version 24H2.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.