{"metadata": {"vulnerability": "CVE-2026-96951", "count": 102, "kinds": {"milestone": 9, "sighting": 65, "kev": 11, "other": 17}}, "data": [{"timestamp": "2025-08-04T16:30:00Z", "date_only": false, "value": "2025-08-04T16:30:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0422", "record": "NCSC-2026-0422", "field": "document.tracking.generator.date"}, {"timestamp": "2026-09-23T20:35:19.928Z", "date_only": false, "value": "2026-09-23T20:35:19.928Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-96951", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-08T00:00:00Z", "date_only": false, "value": "2026-10-08T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-96951", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-08T00:00:00Z", "date_only": false, "value": "2026-10-08T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-96951", "record": "FKIE_CVE-2026-96951", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": false, "value": "2026-10-13T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-96951", "field": "timestamps.asserted_at", "uuid": "ddbf6640-16e5-4ba6-87f2-6ad3daf81d63", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": true, "value": "2026-10-13", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-96951", "field": "containers.adp.0.metrics.1.other.content.dateAdded"}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": true, "value": "2026-10-13", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2026-96951", "field": "evidence.0.details.date_added", "uuid": "ddbf6640-16e5-4ba6-87f2-6ad3daf81d63", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": false, "value": "2026-10-13T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2026-96951", "field": "timestamps.first_seen_at", "uuid": "ddbf6640-16e5-4ba6-87f2-6ad3daf81d63", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": true, "value": "2026-10-13", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1312", "record": "CERTFR-2026-AVI-1312", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": true, "value": "2026-10-13", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1314", "record": "CERTFR-2026-AVI-1314", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": false, "value": "2026-10-13T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2026-96951", "field": "status.status_updated_at", "uuid": "ddbf6640-16e5-4ba6-87f2-6ad3daf81d63", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-13T07:00:00Z", "date_only": false, "value": "2026-10-13T07:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-96951", "field": "timestamps.asserted_at", "uuid": "ddf2fa46-3d78-4af0-8413-17b0c9aebee4", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-13T07:00:00Z", "date_only": false, "value": "2026-10-13T07:00:00.000Z", "kind": "kev", "label": "Catalog added", "source": "previdian", "record": "CVE-2026-96951", "field": "evidence.0.details.added_date", "uuid": "ddf2fa46-3d78-4af0-8413-17b0c9aebee4", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-13T07:00:00Z", "date_only": false, "value": "2026-10-13T07:00:00+00:00", "kind": "kev", "label": "First seen", "source": "previdian", "record": "CVE-2026-96951", "field": "timestamps.first_seen_at", "uuid": "ddf2fa46-3d78-4af0-8413-17b0c9aebee4", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-13T07:00:00Z", "date_only": false, "value": "2026-10-13T07:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "previdian", "record": "CVE-2026-96951", "field": "status.status_updated_at", "uuid": "ddf2fa46-3d78-4af0-8413-17b0c9aebee4", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-13T11:36:28Z", "date_only": false, "value": "2026-10-13T11:36:28.000000Z", "kind": "sighting", "label": "Seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0422", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "9eafaab3-beea-48ca-b34d-e326d6e88c96", "url": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0422"}, {"timestamp": "2026-10-13T13:06:47Z", "date_only": false, "value": "2026-10-13T13:06:47.000000Z", "kind": "sighting", "label": "Seen", "source": "https://cyber.gc.ca/en/alerts-advisories/microsoft-security-advisory-october-2026-monthly-rollup-av26-1038", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "77c0f0c2-0b39-43e7-a5ab-f08f3b0e0920", "url": "https://cyber.gc.ca/en/alerts-advisories/microsoft-security-advisory-october-2026-monthly-rollup-av26-1038"}, {"timestamp": "2026-10-13T14:00:00Z", "date_only": false, "value": "2026-10-13T14:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "CVE-2026-96951", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-13T18:36:28.842Z", "date_only": false, "value": "2026-10-13T18:36:28.842437Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0422", "record": "NCSC-2026-0422", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-13T18:36:28.842Z", "date_only": false, "value": "2026-10-13T18:36:28.842437Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2026-0422", "record": "NCSC-2026-0422", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-10-13T18:36:28.842Z", "date_only": false, "value": "2026-10-13T18:36:28.842437Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0422", "record": "NCSC-2026-0422", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-13T19:01:26.801Z", "date_only": false, "value": "2026-10-13T19:01:26.801Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-96951", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-13T19:22:07Z", "date_only": false, "value": "2026-10-13T19:22:07Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-HJR5-MPPG-MJQ7", "record": "GHSA-HJR5-MPPG-MJQ7", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-13T19:22:07.760Z", "date_only": false, "value": "2026-10-13T19:22:07.760", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-96951", "record": "FKIE_CVE-2026-96951", "field": "published"}, {"timestamp": "2026-10-13T19:27:31.203Z", "date_only": false, "value": "2026-10-13T19:27:31.203119Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mxrrb5lwvq2i", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "c21c1feb-911f-443f-9e07-6f557dfd0f5b", "content": "\ud83d\uded1 CVE-2026-96951\nMicrosoft Windows\nCVSS 8.8 / KEV: No\nTL;DR: Improper neutralization of special elements used in a command ('command injection') in Windows Shel\u2026\nhttps://cvesentinel.com/report/CVE-2026-96951?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mxrrb5lwvq2i"}, {"timestamp": "2026-10-13T20:00:00Z", "date_only": false, "value": "2026-10-13T20:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.hkcert.org/security-bulletin/microsoft-monthly-security-update-october-2026", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "7a11cb67-f732-4adb-8cb7-88117d3d9ce9", "url": "https://www.hkcert.org/security-bulletin/microsoft-monthly-security-update-october-2026"}, {"timestamp": "2026-10-13T20:04:04.308Z", "date_only": false, "value": "2026-10-13T20:04:04.308025Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/ap/users/117202824925377048/statuses/117435389161785482", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "ddf7f00d-a3b2-457e-81ff-9dbfe51891ee", "content": "Placeholder CISA blog post about Ivanti Connect Secure zero-day CVE-2026-104935 and Microsoft Windows Shell Security Feature Bypass zero-day CVE-2026-96951\nhttps://www.cisa.gov/news-events/alerts/2026/10/13/cisa-adds-two-known-exploited-vulnerabilities-catalog\n#CISA #KEV #eitw #zeroday #PatchTuesday", "url": "https://infosec.exchange/ap/users/117202824925377048/statuses/117435389161785482"}, {"timestamp": "2026-10-13T21:00:00Z", "date_only": false, "value": "2026-10-13T21:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=2106", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "c9d05c9f-c1e1-4428-b5c6-911e2790884f", "url": "https://www.govcert.gov.hk/en/alerts_detail.php?id=2106"}, {"timestamp": "2026-10-13T21:00:02Z", "date_only": false, "value": "2026-10-13T21:00:02+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2026-96951", "field": "timestamps.recorded_at", "uuid": "ddbf6640-16e5-4ba6-87f2-6ad3daf81d63", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-13T21:00:03.182Z", "date_only": false, "value": "2026-10-13T21:00:03.182619Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ddbf6640-16e5-4ba6-87f2-6ad3daf81d63", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "e00275ee-aa94-4809-89a7-b67c127cc178", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ddbf6640-16e5-4ba6-87f2-6ad3daf81d63"}, {"timestamp": "2026-10-13T21:06:18.608Z", "date_only": false, "value": "2026-10-13T21:06:18.608319Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/entorisec.bsky.social/post/3mxrwrruzes2e", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "50cc4d0c-b9d1-44a9-9354-03bbc74996e4", "content": "Microsoft's October Patch Tuesday includes one exploited Windows zero-day, per BleepingComputer. CVE-2026-96951 is a Windows Shell command injection that bypasses Mark of the Web. CISA added it to KEV today. bleepingcomputer.com/news/microsoft/microsoft-october-2026-patch-tuesday...", "url": "https://bsky.app/profile/entorisec.bsky.social/post/3mxrwrruzes2e"}, {"timestamp": "2026-10-13T21:20:04.127Z", "date_only": false, "value": "2026-10-13T21:20:04.127914Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aipostdaily.bsky.social/post/3mxrxkf37fz2l", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "c4adbdd0-c061-4ade-977c-97dc2208d17b", "content": "CISA added CVE-2026-96951 to its Known Exploited Vulnerabilities list (2026-10-13).\nMicrosoft Windows Command Injection\n#infosec #KEV", "url": "https://bsky.app/profile/aipostdaily.bsky.social/post/3mxrxkf37fz2l"}, {"timestamp": "2026-10-13T21:37:08Z", "date_only": false, "value": "2026-10-13T21:37:08Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-HJR5-MPPG-MJQ7", "record": "GHSA-HJR5-MPPG-MJQ7", "field": "published"}, {"timestamp": "2026-10-13T21:37:08Z", "date_only": false, "value": "2026-10-13T21:37:08Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-HJR5-MPPG-MJQ7", "record": "GHSA-HJR5-MPPG-MJQ7", "field": "modified"}, {"timestamp": "2026-10-13T22:31:00.703Z", "date_only": false, "value": "2026-10-13T22:31:00.703247Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecircuitry.to/post/3mxs3jajark2j", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "63f6f047-4623-423d-9704-600985752877", "content": "Microsoft's October Patch Tuesday fixes a record 1,411 flaws, per BleepingComputer.\n\n\u2022 3 zero-days, 1 exploited in the wild\n\u2022 CVE-2026-96951: Windows Shell bypass, CVSS 8.8\n\nhttps://thecircuitry.to/article/microsoft-october-2026-patch-tuesday-fixes-1-411-flaws-three-zero-days-mv796kcp", "url": "https://bsky.app/profile/thecircuitry.to/post/3mxs3jajark2j"}, {"timestamp": "2026-10-13T23:15:03.763Z", "date_only": false, "value": "2026-10-13T23:15:03.763311Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ninjaintelgroup.bsky.social/post/3mxs5xzaypj2a", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "4b2c123f-de6c-4089-ba3e-8bc4bdfe15c7", "content": "\ud83d\udea8 NEW on CISA KEV \u2014 exploited in the wild\nMicrosoft Windows: Microsoft Windows Command Injection Vulnerability\nCVE-2026-96951 \u00b7 patch by 2026-10-16\n\ud83d\udd17 https://ninjasignal.ninja/intel/cve/CVE-2026-96951\n#KEV #cybersecurity #infosec", "url": "https://bsky.app/profile/ninjaintelgroup.bsky.social/post/3mxs5xzaypj2a"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1312", "record": "CERTFR-2026-AVI-1312", "field": "last_revision_date"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1314", "record": "CERTFR-2026-AVI-1314", "field": "last_revision_date"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1312", "record": "CERTFR-2026-AVI-1312", "field": "initial_release_date"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1314", "record": "CERTFR-2026-AVI-1314", "field": "initial_release_date"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1312", "record": "CERTFR-2026-AVI-1312", "field": "revisions.0.revision_date"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1314", "record": "CERTFR-2026-AVI-1314", "field": "revisions.0.revision_date"}, {"timestamp": "2026-10-14T00:18:08.426Z", "date_only": false, "value": "2026-10-14T00:18:08.426351Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityrss.bsky.social/post/3mxsbisjygc2s", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "6e69c7d2-3d78-424a-958e-bd3b552edab5", "content": "Microsoft's October 2026 Patch Tuesday addresses 1415 vulnerabilities, including 85 marked as \"critical.\" Notably, CVE-2026-96951, a security feature bypass in Windows Shell, has a CVSS score of 8.8 and is exploited in the wild. Key RCE vulnerabilities include CVE-2026-100202 (CVSS 9.", "url": "https://bsky.app/profile/securityrss.bsky.social/post/3mxsbisjygc2s"}, {"timestamp": "2026-10-14T00:19:41.034Z", "date_only": false, "value": "2026-10-14T00:19:41.034447Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/edwardk/statuses/117436395075123070", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "d40639c2-a0e6-447e-aa96-2469501c1112", "content": "Microsoft Patches More Than 1,400 Security Flaws\nMicrosoft has issued updates fixing more than 1,400 security vulnerabilities in Windows and other software, dwarfing September\u2019s record of nearly 1,000 fixes, Krebs on Security reports. The batch includes one zero-day, CVE-2026-96951, a Windows Shell security feature bypass, and at least 78 flaws rated critical. https://krebsonsecurity.com/2026/10/microsoft-patches-more-than-1400-security-flaws/", "url": "https://infosec.exchange/users/edwardk/statuses/117436395075123070"}, {"timestamp": "2026-10-14T00:20:40Z", "date_only": false, "value": "2026-10-14T00:20:40.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.dk/news/2026-10-14/Microsoft-retter-rekordmange-saarbarheder-i-oktober", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "12c37ec2-35e6-42e8-896b-b7e3133fd860", "url": "https://www.cert.dk/news/2026-10-14/Microsoft-retter-rekordmange-saarbarheder-i-oktober"}, {"timestamp": "2026-10-14T01:49:33Z", "date_only": false, "value": "2026-10-14T01:49:33.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/aggiornamenti-mensili-microsoft-25", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "3d88e3d1-282a-497b-962f-7a946644e427", "url": "https://www.acn.gov.it/portale/w/aggiornamenti-mensili-microsoft-25"}, {"timestamp": "2026-10-14T02:26:34.546Z", "date_only": false, "value": "2026-10-14T02:26:34.546633Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/forsmile.jp/post/3mxsioimctc2a", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "ac7d9c45-5756-44b1-bed0-2316ff456141", "content": "\u3010\u7dca\u6025\u3011Windows\u306e\u8106\u5f31\u6027 CVE-2026-96951\uff08CVSS v3.1 8.8\uff09\u3002\u30cd\u30c3\u30c8\u7531\u6765\u30d5\u30a1\u30a4\u30eb\u306e\u76ee\u5370\uff08MOTW\uff09\u306e\u9632\u5fa1\u3092\u56de\u907f\u3055\u308c\u3001Microsoft\u306f\u60aa\u7528\u3092\u78ba\u8a8d\u6e08\u307f\u300210/13\u306e\u66f4\u65b0\u3067\u4fee\u6b63\u3002Windows Update\u3067\u66f4\u65b0\u30fb\u518d\u8d77\u52d5\u3092\u3002\u5c4a\u3044\u305f\u30d5\u30a1\u30a4\u30eb\u306f\u9001\u308a\u4e3b\u306b\u78ba\u8a8d\u3057\u3066\u304b\u3089\u958b\u304f\u3002\nforsmile.jp/articles/win...\n#\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 #CVE", "url": "https://bsky.app/profile/forsmile.jp/post/3mxsioimctc2a"}, {"timestamp": "2026-10-14T04:06:30.567Z", "date_only": false, "value": "2026-10-14T04:06:30.567699Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mxsob6impw2b", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "73e04a57-26d4-4fc4-b95c-6ef897586517", "content": "@talosintelligence.com\nMicrosoft fixes 1,415 flaws, including 85 critical and one exploited in the wild; Talos released Snort rules.\n-\nIOCs: CVE-2026-96951, CVE-2026-100202, CVE-2026-96207\n-\n#CVE #PatchTuesday #ThreatIntel", "url": "https://bsky.app/profile/cyfar.ca/post/3mxsob6impw2b"}, {"timestamp": "2026-10-14T05:31:25.724Z", "date_only": false, "value": "2026-10-14T05:31:25.724975Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/grams-it.com/post/3mxssywmwq2qh", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "d28ad3a7-1734-426a-9e58-ffc354f6389e", "content": "Patchday Oktober 2026: 1.411 L\u00fccken, 70 kritisch, 59 davon wurmf\u00e4hig. Aktiv ausgenutzt: ein MOTW-Bypass in der Windows Shell (CVE-2026-96951). Dazu RCE in AD DS, DHCP-Server im Failover-Modus und Exchange. Was zuerst auf die Server geh\u00f6rt:\n\nblog.grams-it.com/2026/10/14/2...\n\n#PatchTuesday", "url": "https://bsky.app/profile/grams-it.com/post/3mxssywmwq2qh"}, {"timestamp": "2026-10-14T05:49:53Z", "date_only": false, "value": "2026-10-14T05:49:53.000000Z", "kind": "sighting", "label": "Seen", "source": "https://ccb.belgium.be/advisories/warning-microsoft-patch-tuesday-october-2026-patches-1407-vulnerabilities-69-critical", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "d4a596bc-8afe-4ff8-89ad-85ac06bc7746", "url": "https://ccb.belgium.be/advisories/warning-microsoft-patch-tuesday-october-2026-patches-1407-vulnerabilities-69-critical"}, {"timestamp": "2026-10-14T05:50:01.356Z", "date_only": false, "value": "2026-10-14T05:50:01.356335Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mxsu2bj3t32n", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "40aa03b0-5ec3-40af-b05b-b2e8974faefa", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-96951: Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized at\u2026\nCVSS 8.8 \u00b7 CISA KEV \u00b7 0day\nhttps://beta.vulnsea.com/cve/CVE-2026-96951\n\n#CVE #infosec #cybersecurity #threatintel", "url": "https://bsky.app/profile/vulnsea.com/post/3mxsu2bj3t32n"}, {"timestamp": "2026-10-14T06:00:12.290Z", "date_only": false, "value": "2026-10-14T06:00:12.290140Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberdine.ch/post/3mxsumhe3x522", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "f6c8f1d8-4841-4d19-8bec-789d2f3f94cc", "content": "Der Patchday von gestern war der gr\u00f6sste aller Zeiten. Wie gross genau, da nennen vier Quellen vier Zahlen \u2014 1409 bis 1417.\n\nEinig sind sie sich bei einer: CVE-2026-96951 wird angegriffen und hebelt die Download-Warnung von Windows aus.\n\nhttps://cyberdine.ch/news/der-eine-von-vierzehnhundert", "url": "https://bsky.app/profile/cyberdine.ch/post/3mxsumhe3x522"}, {"timestamp": "2026-10-14T06:06:18.594Z", "date_only": false, "value": "2026-10-14T06:06:18.594952Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/allaboutsecurity.bsky.social/post/3mxsuxbnn322h", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "5da9910f-e136-4274-867c-a7c94ee16afe", "content": "Patch Tuesday Oktober 2026: Microsoft schlie\u00dft 1.417 Sicherheitsl\u00fccken - Eine L\u00fccke war bereits vor dem Patch Tuesday \u00f6ffentlich bekannt, eine weitere, CVE-2026-96951 in der Windows-Shell, wird schon ausgenutzt. \nshorturl.at/flWrb\n\n#patchtuesday #microsoft", "url": "https://bsky.app/profile/allaboutsecurity.bsky.social/post/3mxsuxbnn322h"}, {"timestamp": "2026-10-14T06:34:23.774Z", "date_only": false, "value": "2026-10-14T06:34:23.774769Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybowl.bsky.social/post/3mxswjm6dsb2s", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "a91482b2-a423-4820-9358-1fa39c3672ff", "content": "\ud83d\udd34 Exploitation confirm\u00e9e (CISA KEV, ajouts du 13/10) \u00b7 2\n\u2022 Ivanti Connect Secure CVE-2026-104935, CVSS 8.6\n\u2022 Microsoft Windows CVE-2026-96951, CVSS 8.8", "url": "https://bsky.app/profile/cybowl.bsky.social/post/3mxswjm6dsb2s"}, {"timestamp": "2026-10-14T07:00:01Z", "date_only": false, "value": "2026-10-14T07:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "previdian", "record": "CVE-2026-96951", "field": "timestamps.recorded_at", "uuid": "ddf2fa46-3d78-4af0-8413-17b0c9aebee4", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-14T07:00:56.096Z", "date_only": false, "value": "2026-10-14T07:00:56.096350Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ddf2fa46-3d78-4af0-8413-17b0c9aebee4", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "06676b12-b9a3-4b86-bbe7-06643ed37855", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ddf2fa46-3d78-4af0-8413-17b0c9aebee4"}, {"timestamp": "2026-10-14T07:02:13.465Z", "date_only": false, "value": "2026-10-14T07:02:13.465246Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mxsy3eaqxw26", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "09208fe9-1daa-4ee6-858f-915293efba0e", "content": "\u30cf\u30c3\u30ab\u30fc\u304cWindows Shell\u306e\u30bc\u30ed\u30c7\u30a4\u3092\u60aa\u7528\u3001Mark of the\u00a0Web\u306b\u3088\u308b\u4fdd\u8b77\u3092\u56de\u907f\n\nMicrosoft\u306f\u3001\u4fe1\u983c\u3067\u304d\u306a\u3044\u5834\u6240\u304b\u3089\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3057\u305f\u30d5\u30a1\u30a4\u30eb\u3078\u306e\u4fdd\u8b77\u3092\u5f31\u3081\u308b\u3001\u5b9f\u969b\u306b\u60aa\u7528\u3055\u308c\u3066\u3044\u308bWindows Shell\u306e\u8106\u5f31\u6027\u3092\u4fee\u6b63\u3057\u307e\u3057\u305f\u3002\u3053\u306e\u8106\u5f31\u6027\u3092\u7a81\u304b\u308c\u308b\u3068\u3001\u653b\u6483\u8005\u306fMark of the Web\uff08MOTW\uff09\u3092\u56de\u907f\u3067\u304d\u307e\u3059\u3002 \u8106\u5f31\u6027\u306f\u300cCVE-2026-96951\u300d\u3068\u3057\u3066\u8ffd\u8de1\u3055\u308c\u3066\u304a\u308a\u30012026\u5e74", "url": "https://bsky.app/profile/blackhatnews.tokyo/post/3mxsy3eaqxw26"}, {"timestamp": "2026-10-14T07:41:03.878Z", "date_only": false, "value": "2026-10-14T07:41:03.878925Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mxt27eigr26c", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "d35a9091-afa7-4e10-8e3c-a2c5e0c45014", "content": "\u300c\u3053\u306e\u5185 CVE-2026-96951 \u306e\u8106\u5f31\u6027\u306b\u3064\u3044\u3066\u3001Microsoft \u793e\u3067\u306f\u60aa\u7528\u306e\u4e8b\u5b9f\u3092\u78ba\u8a8d\u6e08\u307f\u3068\u516c\u8868\u3057\u3066\u304a\u308a\u3001\u4eca\u5f8c\u88ab\u5bb3\u304c\u62e1\u5927\u3059\u308b\u304a\u305d\u308c\u304c\u3042\u308b\u305f\u3081\u3001\u81f3\u6025\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u66f4\u65b0\u30d7\u30ed\u30b0\u30e9\u30e0\u3092\u9069\u7528\u3057\u3066\u304f\u3060\u3055\u3044\u3002\u300d", "url": "https://bsky.app/profile/shiojiri.com/post/3mxt27eigr26c"}, {"timestamp": "2026-10-14T07:45:29.469Z", "date_only": false, "value": "2026-10-14T07:45:29.469667Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mxt2iqfu4s2q", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "afaf64f3-8918-47d2-a7bb-e40cb65a96a3", "content": "October 2026 Patch Tuesday fixes 1,413 CVEs, including exploited Windows zero-day CVE-2026-96951, and adds KEV catalog guidance for federal agencies.\n", "url": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mxt2iqfu4s2q"}, {"timestamp": "2026-10-14T07:45:44.687Z", "date_only": false, "value": "2026-10-14T07:45:44.687311Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mxt2j6rt7q2o", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "05bab3d6-4f6a-49b1-ba98-8deeba97bafe", "content": "October 2026 Patch Tuesday fixes 1,413 CVEs, including exploited Windows zero-day CVE-2026-96951, and adds KEV catalog guidance for federal agencies.\n", "url": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mxt2j6rt7q2o"}, {"timestamp": "2026-10-14T07:45:51.956Z", "date_only": false, "value": "2026-10-14T07:45:51.956017Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mxt2jfl6ln2t", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "198f3c75-74fd-426d-92fe-1e2253ba2b9b", "content": "October 2026 Patch Tuesday fixes 1,413 CVEs, including exploited Windows zero-day CVE-2026-96951, and adds KEV catalog guidance for federal agencies.\n", "url": "https://bsky.app/profile/privpros.bsky.social/post/3mxt2jfl6ln2t"}, {"timestamp": "2026-10-14T08:01:09.468Z", "date_only": false, "value": "2026-10-14T08:01:09.468009Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/helpnetsecurity.com/post/3mxt3epd2l22p", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "88f6b806-607c-4ea8-bb7f-80237046f7bb", "content": "Microsoft fixes exploited Mark of the Web bypass vulnerability (CVE-2026-96951)\n\n\ud83d\udcd6 Read more: www.helpnetsecurity.com/2026/10/14/m...\n\n#cybersecurity #cybersecuritynews #0day #SharepointServer @microsoft.com @dustinchilds.bsky.social @thezdi.bsky.social @satn.am @tenablesecurity.bsky.social", "url": "https://bsky.app/profile/helpnetsecurity.com/post/3mxt3epd2l22p"}, {"timestamp": "2026-10-14T08:34:31.326Z", "date_only": false, "value": "2026-10-14T08:34:31.326848Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ytroncal.bsky.social/post/3mxt5adwklk2g", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "35319c1b-0d5e-4087-927b-dd8cd68650b3", "content": "Windows Shell CVE-2026-96951: Mark of the Web Bypass Zero-Day Actively Exploited dev.to/anoymask/win...", "url": "https://bsky.app/profile/ytroncal.bsky.social/post/3mxt5adwklk2g"}, {"timestamp": "2026-10-14T08:40:04.324Z", "date_only": false, "value": "2026-10-14T08:40:04.324129Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mxt5kdrto72q", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "a02f467b-19d9-4a1c-ad2d-d86e58b78d16", "content": "\ud83e\udd16 Record Patch Tuesday: Microsoft patched 1,413 flaws. CVE-2026-96951 (CVSS 8.8), a Windows Shell command injection bypassing Mark of the Web, is exploited in the wild. Two more zero-days publicly disclosed.\nhttps://thehackernews.com/2026/10/microsoft-patches-record-1413-flaws.html", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mxt5kdrto72q"}, {"timestamp": "2026-10-14T08:42:50.881Z", "date_only": false, "value": "2026-10-14T08:42:50.881880Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mxt5pcnztm2i", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "33cea14e-7eac-49d7-8bd2-d3518925f698", "content": "Microsoft\u304c\u60aa\u7528\u3055\u308c\u305fMark of the Web\u30d0\u30a4\u30d1\u30b9\u306e\u8106\u5f31\u6027\uff08CVE-2026-96951\uff09\u3092\u4fee\u6b63\n\nMicrosoft\u306f\u4eca\u56de\u3082\u904e\u53bb\u6700\u591a\u3092\u66f4\u65b0\u3057\u305f\u6708\u4f8b\u30d1\u30c3\u30c1\uff08Patch Tuesday\uff09\u3067\u30011,400\u4ef6\u3092\u8d85\u3048\u308b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4e0a\u306e\u4e0d\u5177\u5408\u3092\u4fee\u6b63\u3057\u307e\u3057\u305f\u3002\u3053\u306e\u306a\u304b\u306b\u306f\u3001\u653b\u6483\u8005\u306b\u3088\u3063\u3066\u5b9f\u969b\u306b\u60aa\u7528\u3055\u308c\u3066\u3044\u308bMark of the Web\uff08MotW\uff09\u30d0\u30a4\u30d1\u30b9\u306e\u8106\u5f31\u6027\uff08CVE-2026-96951\uff09\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002", "url": "https://bsky.app/profile/blackhatnews.tokyo/post/3mxt5pcnztm2i"}, {"timestamp": "2026-10-14T09:06:46.257Z", "date_only": false, "value": "2026-10-14T09:06:46.257282Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hapsis.bsky.social/post/3mxt722qv322i", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "3a29a371-b4a3-4b03-a6a1-bb08cfe9a5b5", "content": "Microsoft fixes exploited Mark of the Web bypass vulnerability (CVE-2026-96951)\n\nwww.helpnetsecurity.com/2026/10/14/m...\n\n#Cybersecurity #ThreatIntel #Vulnerability", "url": "https://bsky.app/profile/hapsis.bsky.social/post/3mxt722qv322i"}, {"timestamp": "2026-10-14T11:22:47.301Z", "date_only": false, "value": "2026-10-14T11:22:47.301486Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117439002492107614", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "0e4372d8-66c1-4d62-a16d-f705e0c985ed", "content": "CVE-2026-96951 Windows Shell Security Feature Bypass Vulnerability Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.\nhttps://www.cve.org/CVERecord?id=CVE-2026-96951https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951#Microsoft #Outlook.com #Windows10Version1607 #Windows10Version1809 #Windows10Version21H2 #Windows10Version22H2 #Windows11version23H2 #Windows11Version23H2 #Windows11Version24H2 #Windows11Version25H2 #Windows11version26H1 #Windows11Version26H2 #WindowsServer2012R2 #WindowsServer2012R2(ServerCoreinstallation) #WindowsServer2016 #WindowsServer2016(ServerCoreinstallation) #WindowsServer2019 #WindowsServer2019(ServerCoreinstallation) #WindowsServer2022 #WindowsServer2025 #WindowsServer2025(ServerCoreinstallation)#CVE_2026_96951#bot", "url": "https://infosec.exchange/users/cve/statuses/117439002492107614"}, {"timestamp": "2026-10-14T11:32:27.164Z", "date_only": false, "value": "2026-10-14T11:32:27.164000Z", "kind": "sighting", "label": "Exploited", "source": "https://www.kaspersky.com/blog/2026-october-patch-tuesday/56554", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "73c0c010-ede9-4dcb-9f82-a73558c774d6", "url": "https://www.kaspersky.com/blog/2026-october-patch-tuesday/56554"}, {"timestamp": "2026-10-14T12:44:55.645Z", "date_only": false, "value": "2026-10-14T12:44:55.645970Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/mariogalarza.bsky.social/post/3mxtla6h7pc2n", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "4d6089f6-1737-48e0-b25b-a634d1f8a25a", "content": "Microsoft just patched a record 1,413 flaws \u2014 and one Windows Shell bug (CVE-2026-96951) is already being exploited in the wild.\n\nPatch the exploited bug first. Stage your rollout. Hunt every Windows server.\n\nFull breakdown: https://www.linkedin.com/feed/update/urn:li:share:7516116782550630400/", "url": "https://bsky.app/profile/mariogalarza.bsky.social/post/3mxtla6h7pc2n"}, {"timestamp": "2026-10-14T13:00:15.006Z", "date_only": false, "value": "2026-10-14T13:00:15.006089Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/marco-odev.bsky.social/post/3mxtm3liaqi26", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "11764492-99e2-4358-b156-6f8df945ccaf", "content": "Microsoft sac\u00f3 hoy su parche mensual m\u00e1s grande: m\u00e1s de 1,400 fallos. Uno ya se est\u00e1 explotando (CVE-2026-96951): se salta el aviso de \u00abeste archivo viene de internet\u00bb.\n\nSi tu Windows 11 es 24H2 Home o Pro, este es su \u00faltimo parche. Inst\u00e1lalo hoy.\n\n\u00bfTienes las actualizaciones autom\u00e1ticas?", "url": "https://bsky.app/profile/marco-odev.bsky.social/post/3mxtm3liaqi26"}, {"timestamp": "2026-10-14T14:02:18.718Z", "date_only": false, "value": "2026-10-14T14:02:18.718413Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mxtpkjjeqm26", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "8938a8ab-a27a-4c88-b809-8bed9372a593", "content": "Microsoft's October 2026 Patch Tuesday is a record-breaker, fixing 1,413 vulnerabilities. Includes patch for actively exploited zero-day CVE-2026-96951 (Windows Shell MotW bypass). CISA KEV added. #PatchTuesday #CyberSecurity #ZeroDay\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "url": "https://bsky.app/profile/netsecio.bsky.social/post/3mxtpkjjeqm26"}, {"timestamp": "2026-10-14T14:02:29.847Z", "date_only": false, "value": "2026-10-14T14:02:29.847698Z", "kind": "sighting", "label": "Seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117439627895987632", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "a8cfc27b-33fb-4c99-a125-2bf55d74a5cf", "content": "\ud83d\udcf0 Microsoft's Record October Patch Tuesday Fixes 1,413 Flaws, 1 Exploited Zero-Day\nMicrosoft's October 2026 Patch Tuesday is a record-breaker, fixing 1,413 vulnerabilities. Includes patch for actively exploited zero-day CVE-2026-96951 (Windows Shell MotW bypass). CISA KEV added. #PatchTuesday #CyberSecurity #ZeroDay\n\ud83d\udd17 https://cyber.netsecops.io/articles/microsoft-october-2026-patch-tuesday-fixes-1413-flaws-one-exploited-zero-day/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "url": "https://mastodon.social/ap/users/115426718704364579/statuses/117439627895987632"}, {"timestamp": "2026-10-14T15:12:25.274Z", "date_only": false, "value": "2026-10-14T15:12:25.274782Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/us-brief.com/post/3mxtthvjnl42p", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "79d43f97-1b56-4230-ab74-41bf9d17dd33", "content": "Microsoft's October Patch Tuesday hits record 1,400+ flaws\n\nMicrosoft's October 2026 security updates address about 1,413\u20131,414 vulnerabilities, including actively exploited Windows Shell flaw CVE-2026-96951 that can bypass Mark of the Web. CISA ordered federal agencies to patch that bug by Oct. 16.", "url": "https://bsky.app/profile/us-brief.com/post/3mxtthvjnl42p"}, {"timestamp": "2026-10-14T16:01:58.311Z", "date_only": false, "value": "2026-10-14T16:01:58.311926Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mxtwajo6vm23", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "db2e2424-330f-41f5-86b5-3a03c619fbcc", "content": "~Cybergcca~\nMicrosoft CVE-2026-96951 is exploited and in CISA KEV; update affected Microsoft and Adobe products.\n-\nIOCs: CVE-2026-96951\n-\n#CVE-2026-96951 #Microsoft #ThreatIntel", "url": "https://bsky.app/profile/cyfar.ca/post/3mxtwajo6vm23"}, {"timestamp": "2026-10-14T16:49:11.295Z", "date_only": false, "value": "2026-10-14T16:49:11.295024Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/inferlume.bsky.social/post/3mxtyut6b5c2t", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "730ec08f-6a93-4de9-a52a-ac8fdf1b865f", "content": "Active zero day attacks on Ivanti Connect Secure grant root execution & steal Active Directory secrets while Windows Shell CVE-2026-96951 evades Mark of the Web checks. Access our comprehensive analytical briefing.\n\ninferlume.com/reports/dail...\n\n#ThreatIntel #Ivanti #Windows #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/inferlume.bsky.social/post/3mxtyut6b5c2t"}, {"timestamp": "2026-10-14T17:16:13.170Z", "date_only": false, "value": "2026-10-14T17:16:13.170662Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/techygeekshome.bsky.social/post/3mxu2ev3t4s2o", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "9078585c-64da-445d-845d-ae7e6cbd8fbc", "content": "Patched yet? October's updates fix a Windows Shell bug (CVE-2026-96951) that was already being used in attacks. Here's what to patch first, the KB for every Windows version and the Remote Desktop issue to watch for: youtu.be/EVTyMi10hEk", "url": "https://bsky.app/profile/techygeekshome.bsky.social/post/3mxu2ev3t4s2o"}, {"timestamp": "2026-10-14T18:15:30.406Z", "date_only": false, "value": "2026-10-14T18:15:30.406788Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mxu5pc3usk2q", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "e70bf0ca-4916-4eda-adf1-83771123a848", "content": "\ud83d\udee1\ufe0f Most-discussed CVEs on Bluesky, last 24h\n\n1. CVE-2026-104935 \u00b7 30 people \ud83d\udd25\n2. CVE-2026-96951 \u00b7 29 people \ud83d\udd25\n3. CVE-2026-97229 \u00b7 10 people\n4. CVE-2026-105445 \u00b7 9 people\n5. CVE-2026-74580 \u00b7 9 people\n\n\ud83d\udd25 = on CISA's Known Exploited list \u00b7 details in the thread \ud83e\uddf5", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mxu5pc3usk2q"}, {"timestamp": "2026-10-14T18:15:31.365Z", "date_only": false, "value": "2026-10-14T18:15:31.365074Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mxu5pcadf22q", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "baa0c751-b623-4189-9dad-6ff3b7ac0fbd", "content": "2. CVE-2026-96951 \u00b7 29 people \ud83d\udd25\n\ud83d\udfe7 High 8.8 \u00b7 Microsoft Outlook.com\n\nImproper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mxu5pcadf22q"}, {"timestamp": "2026-10-14T18:42:32.801Z", "date_only": false, "value": "2026-10-14T18:42:32.801173Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mxu77nhhrc24", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "a6bc0330-b8f6-4c8d-90ab-0b0103dc22b9", "content": "CVE-2026-96951 is trending. Hype score 4, currently #7 on cvemon.\n\nImproper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.\n\nhttps://cvemon.intruder.io/cves/CVE-2026-96951", "url": "https://bsky.app/profile/cvemon.bsky.social/post/3mxu77nhhrc24"}, {"timestamp": "2026-10-14T19:46:46.285Z", "date_only": false, "value": "2026-10-14T19:46:46.285997Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/spadge.bsky.social/post/3mxucsh4zms2e", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "b04e6c50-4d56-46ee-8968-e49c906ab46a", "content": "More and more security updates. This latest is to patch a particularly nasty vulnerability that is being exploited out there in the wild already. (CVE-2026-96951). \nThe enshittification continues.", "url": "https://bsky.app/profile/spadge.bsky.social/post/3mxucsh4zms2e"}, {"timestamp": "2026-10-14T20:03:26.345Z", "date_only": false, "value": "2026-10-14T20:03:26.345005Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/mauriciocassemiro.bsky.social/post/3mxudqbxpwg2i", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "7930b75b-938f-4066-9f35-e22d600f819c", "content": "Falha no Windows j\u00e1 explorada: um anexo pode escapar do aviso de \"arquivo baixado da internet\" (Mark of the Web). A corre\u00e7\u00e3o saiu no pacote de 13/10 (CVE-2026-96951).\n\nRode o Windows Update e reinicie ainda hoje.\n\n#Windows11", "url": "https://bsky.app/profile/mauriciocassemiro.bsky.social/post/3mxudqbxpwg2i"}, {"timestamp": "2026-10-14T21:09:26.626Z", "date_only": false, "value": "2026-10-14T21:09:26.626572Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/tech2geek.mastodon.social.ap.brid.gy/post/3mxuhga3q2ow2", "record": "cve-2026-96951", "field": "creation_timestamp", "uuid": "fd568bb3-0784-4d35-907a-c31849801330", "content": "Windows Update Fixes Actively Exploited Security Vulnerability CVE-2026-96951\nhttps://www.tech2geek.net/windows-update-fixes-actively-exploited-security-vulnerability-cve-2026-96951/", "url": "https://bsky.app/profile/tech2geek.mastodon.social.ap.brid.gy/post/3mxuhga3q2ow2"}, {"timestamp": "2026-10-14T22:01:07.560Z", "date_only": false, "value": "2026-10-14T22:01:07.560534Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/jeeves-ai.bsky.social/post/3mxukcqpced2m", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "4a78c1cb-167a-4620-a377-17d6f7cf5128", "content": "2/ Solo una explotada en el wild: CVE-2026-96951, bypass de Windows Shell por inyecci\u00f3n de comandos (CVSS 8,8). Con explotaci\u00f3n \u00abm\u00e1s probable\u00bb: AD DS (CVE-2026-70229) y Exchange (CVE-2026-70571), ambos RCE 8,1. Empiecen por el dominio.", "url": "https://bsky.app/profile/jeeves-ai.bsky.social/post/3mxukcqpced2m"}, {"timestamp": "2026-10-15T01:03:05.365Z", "date_only": false, "value": "2026-10-15T01:03:05.365835Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/threatcodex/statuses/117442228056269732", "record": "cve-2026-96951", "field": "creation_timestamp", "uuid": "3f9052b5-1f27-402e-967c-a775b9c43c4c", "content": "CVE-2026-96951: Actively Exploited Windows Shell Zero-Day Bypasses Mark of the Web#CVE_2026_96951 #MicrosoftOperatingSystems https://socprime.com/blog/cve-2026-96951-analysis/", "url": "https://infosec.exchange/users/threatcodex/statuses/117442228056269732"}, {"timestamp": "2026-10-15T02:07:07.148Z", "date_only": false, "value": "2026-10-15T02:07:07.148291Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mxuy2m3kfz2u", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "1cd7eecf-4501-4837-bd11-72cb18f2ccb1", "content": "\ud83d\udccc CVE-2026-96951 - Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a secur... https://www.cyberhub.blog/cves/CVE-2026-96951", "url": "https://bsky.app/profile/cyberhub.blog/post/3mxuy2m3kfz2u"}, {"timestamp": "2026-10-15T06:21:55.729Z", "date_only": false, "value": "2026-10-15T06:21:55.729877Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mxvgcaicci25", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "f362e947-d857-44a6-bb57-b1ecf4391df5", "content": "Top 3 CVE for last 7 days:\nCVE-2026-92392: 62 interactions\nCVE-2026-97229: 36 interactions\nCVE-2026-104935: 35 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-92392: 55 interactions\nCVE-2026-96951: 20 interactions\nCVE-2026-104935: 9 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mxvgcaicci25"}, {"timestamp": "2026-10-15T07:11:03.484Z", "date_only": false, "value": "2026-10-15T07:11:03.484351Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aiuto-ch.bsky.social/post/3mxvj22iiygbz", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "f7e54b67-0e6a-437a-8da3-527636557662", "content": "CISA KEV | CVE-2026-96951 | Microsoft / Windows\n\nCISA lists this vulnerability as exploited in the wild. Check affected products and vendor guidance.\n\nSource: CISA KEV\n\nFull analysis: https://t.me/aiutocomputerhelp_lab/1272", "url": "https://bsky.app/profile/aiuto-ch.bsky.social/post/3mxvj22iiygbz"}, {"timestamp": "2026-10-15T09:03:45.886Z", "date_only": false, "value": "2026-10-15T09:03:45.886520Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/vuldb/statuses/117444118146898764", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "f2f32830-c4c1-49b8-ae00-d30f4e561b27", "content": "\ud83d\udea8 It is possible to see elevated activities targeting Microsoft Windows (CVE-2026-96951) https://vuldb.com/vuln/419662/cti", "url": "https://infosec.exchange/users/vuldb/statuses/117444118146898764"}, {"timestamp": "2026-10-15T09:41:17.208Z", "date_only": false, "value": "2026-10-15T09:41:17.208467Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/trustlist.bsky.social/post/3mxvrgpnnhp25", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "74904619-acc1-48aa-92c2-52fc77f28652", "content": "News 4/29\nMicrosoft fixes 1,413 flaws, one Windows Shell bug already exploited\n\nCISA gave US federal agencies until 16 October to patch CVE-2026-96951, a Mark of the Web bypass.\n\n#infosec #cybersecurity\ntrustlist.uk/news/microsoft-oct\u2026", "url": "https://bsky.app/profile/trustlist.bsky.social/post/3mxvrgpnnhp25"}, {"timestamp": "2026-10-15T16:20:34.512Z", "date_only": false, "value": "2026-10-15T16:20:34.512628Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/nile11.bsky.social/post/3mxwhqovnnf2l", "record": "cve-2026-96951", "field": "creation_timestamp", "uuid": "e9214ea4-5119-437d-8f78-769c33c30106", "content": "Microsoft October 2026 Patch Tuesday Fixes Record 1,413 Flaws\n..................\nhttps://nile1.com/microsoft-october-2026-patch-tuesday-fixes-record-1413-flaws/\n..................\n#.netFramework #cve-2026-96951 #messagepack-csharp #microsoftSecurityUpdates #october2026PatchTuesday #riskCohorts #wind", "url": "https://bsky.app/profile/nile11.bsky.social/post/3mxwhqovnnf2l"}, {"timestamp": "2026-10-15T18:15:50.145Z", "date_only": false, "value": "2026-10-15T18:15:50.145637Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mxwo6sifl22s", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "a63bf84f-5781-4162-8ae6-8e7f5b011ba4", "content": "\ud83d\udee1\ufe0f Most-discussed CVEs on Bluesky, last 24h\n\n1. CVE-2026-0322 \u00b7 30 people \ud83d\udd25\n2. CVE-2026-76519 \u00b7 30 people \ud83d\udd25\n3. CVE-2026-96951 \u00b7 11 people \ud83d\udd25\n4. CVE-2026-105133 \u00b7 10 people \ud83d\udd25\n5. CVE-2026-105134 \u00b7 8 people \ud83d\udd25\n\n\ud83d\udd25 = on CISA's Known Exploited list \u00b7 details in the thread \ud83e\uddf5", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mxwo6sifl22s"}, {"timestamp": "2026-10-15T18:15:51.489Z", "date_only": false, "value": "2026-10-15T18:15:51.489144Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mxwo6sqbjk2s", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "65884be9-979d-4dd7-8d92-a8fd718d3594", "content": "3. CVE-2026-96951 \u00b7 11 people \ud83d\udd25\n\ud83d\udfe7 High 8.8 \u00b7 Microsoft Outlook.com\n\nImproper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mxwo6sqbjk2s"}, {"timestamp": "2026-10-16T00:00:00Z", "date_only": true, "value": "2026-10-16", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2026-96951", "field": "evidence.0.details.due_date", "uuid": "ddbf6640-16e5-4ba6-87f2-6ad3daf81d63", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-16T03:56:31.910Z", "date_only": false, "value": "2026-10-16T03:56:31.910Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-96951", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T05:56:30.150Z", "date_only": false, "value": "2026-10-16T05:56:30.150834Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/bot-de-florian.bsky.social/post/3mxxvdpckpk2o", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "8176c9c6-9aec-405c-9a14-e0b89acfbad2", "content": "\u2022Microsoft Patch Tuesday : >1 400 correctifs (record), 1 zero-day (CVE-2026-96951).\n\u2022D-Link & Ubiquiti d\u00e9tourn\u00e9s dans 34 pays (proxyjacking).\nhttps://krebsonsecurity.com/2026/10/microsoft-patches-more-than-1400-security-flaws/", "url": "https://bsky.app/profile/bot-de-florian.bsky.social/post/3mxxvdpckpk2o"}, {"timestamp": "2026-10-16T06:32:22.624Z", "date_only": false, "value": "2026-10-16T06:32:22.624066Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mxxxdtwhih2k", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "b6371dc6-7c77-4ffb-81cc-e5000d193bf9", "content": "Windows Shell\u306e\u30bc\u30ed\u30c7\u30a4\u8106\u5f31\u6027\u3001Mark of the Web\u306b\u3088\u308b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4fdd\u8b77\u3092\u56de\u907f\u3055\u308c\u308b\u6050\u308c\n\nMicrosoft\u306f\u3001\u653b\u6483\u8005\u304c\u5b9f\u969b\u306b\u60aa\u7528\u3057\u3066\u3044\u308bWindows Shell\u306e\u8106\u5f31\u6027\u306b\u5bfe\u51e6\u3057\u307e\u3057\u305f\u3002\u3053\u306e\u8106\u5f31\u6027\u3092\u60aa\u7528\u3055\u308c\u308b\u3068\u3001Mark of the Web(MOTW)\u306b\u3088\u308b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4fdd\u8b77\u3092\u56de\u907f\u3055\u308c\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002StudySecurity \u3053\u306e\u8106\u5f31\u6027\u306f\u300cCVE-2026-96951\u300d\u3068\u3057\u3066\u8b58\u5225\u3055\u308c\u3066\u304a\u308a\u3001202", "url": "https://bsky.app/profile/blackhatnews.tokyo/post/3mxxxdtwhih2k"}, {"timestamp": "2026-10-16T17:18:00.760Z", "date_only": false, "value": "2026-10-16T17:18:00.760", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-96951", "record": "FKIE_CVE-2026-96951", "field": "lastModified"}, {"timestamp": "2026-10-16T17:25:20.321Z", "date_only": false, "value": "2026-10-16T17:25:20.321646Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/theperimetersite.bsky.social/post/3mxz3tgpda226", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "166dc243-7e69-4235-b8d6-c7a75eb9f0b5", "content": "Federal agencies have until today to patch the Ivanti Connect Secure authentication bypass (CVE-2026-104935) and the Microsoft Windows command injection flaw (CVE-2026-96951). The rest of us?\n\n#vulnerability #infosec", "url": "https://bsky.app/profile/theperimetersite.bsky.social/post/3mxz3tgpda226"}, {"timestamp": "2026-10-16T23:25:28.787Z", "date_only": false, "value": "2026-10-16T23:25:28.787Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-96951", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-16T23:25:28.787Z", "date_only": false, "value": "2026-10-16T23:25:28.787Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / microsoft", "record": "CVE-2026-96951", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-17T03:44:03.852Z", "date_only": false, "value": "2026-10-17T03:44:03.852373Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/jarkafterdark.com/post/3my26fsjhzj2y", "record": "cve-2026-96951", "field": "creation_timestamp", "uuid": "08d5db17-98bb-40d0-8118-cb0565cae41c", "content": "the exploited one is cve-2026-96951, a windows shell flaw that bypasses mark of the web. mark of the web is the tag windows attaches to a file you download. the thing triggering the \u201care you sure you want to run this\u201d warning.", "url": "https://bsky.app/profile/jarkafterdark.com/post/3my26fsjhzj2y"}, {"timestamp": "2026-10-17T17:49:01.568Z", "date_only": false, "value": "2026-10-17T17:49:01.568984Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/arc-codex.com/post/3my3nmpllik2y", "record": "CVE-2026-96951", "field": "creation_timestamp", "uuid": "8b607814-e58f-4f5a-8b96-e1b25ec5563c", "content": "Alert: Notice Regarding Microsoft Security Updates for October 2026 (Public)\n\nThis article frames CVE-2026-96951 as an immediate, actionable threat requiring only the application of standard updates to mitigate its \"Vulnerability to Bypass Windows Shell Security Features.\" How\u2026\n\nvia JPCERT/CC Alerts", "url": "https://bsky.app/profile/arc-codex.com/post/3my3nmpllik2y"}]}