CVE-2026-96951

As of October 13, 2026, Microsoft is affected by vulnerabilities in the following products: .NET 10.0 .NET 11.0 .NET 8.0 .NET 9.0 ASP.NET Core 10.0 ASP.NET Core 11.0 ASP.NET Core 8.0 ASP.NET Core 9.0 Arc Enabled Servers Azure API Center Azure App Service for Linux Azure CLI Azure CycleCloud Azure Container Storage enabled by Azure Arc Azure Event Grid System Azure SRE Agent Azure Storage Blobs client library for Java HVEC Video Extensions Microsoft .NET Framework 3.5 AND 4.8.1 Microsoft .NET Framework 4.8.1 Microsoft 365 Apps for Enterprise Microsoft Bookings Microsoft Configuration Manager 2503 Microsoft Configuration Manager 2509 Microsoft Configuration Manager 2603 Microsoft Defender for Endpoint Microsoft Dataverse Microsoft Dynamics 365 (on-premises) version 9.1 Microsoft Dynamics NAV 2017 Microsoft Dynamics NAV 2018 Microsoft Exchange Server 2016 Microsoft Exchange Server 2019 Microsoft Exchange Server Subscription Edition RTM Microsoft Office 365 Microsoft Office LTSC 2021 Microsoft Office LTSC 2024 Microsoft Office Online Server Microsoft Outlook Microsoft Paint Microsoft Partner Center Microsoft Power Apps Microsoft PowerToys Microsoft SQL Server 2017 Microsoft SQL Server 2019 Microsoft SQL Server 2022 Microsoft SQL Server 2025 Microsoft SharePoint Enterprise Server 2016 Microsoft SharePoint Server 2019 Microsoft SharePoint Server Subscription Edition Microsoft Visual Studio 2022 Microsoft Visual Studio 2026 PowerShell 7.4 PowerShell 7.5 PowerShell 7.6 Raw Image Extension on Windows 10 Raw Image Extension on Windows 11 Skype for Business Server 2015 Skype for Business Server 2019 Skype for Business Server Subscription Edition CU1 Skype for Business Server Subscription Edition RTM Sysinternals Suite Visual Studio Code Windows 10 Windows 11 Windows Defender Windows Security App Windows Server 2012 Windows Server 2012 R2 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025 Microsoft has indicated that CVE-2026-96951 has been exploited. On October 13, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-96951 to their Known Exploited Vulnerabilities (KEV) Database. The Cyber Centre encourages users and administrators to review the web link provided, perform the suggested mitigations, and apply the necessary updates.

EPSS 1.51% · 74.0th percentile