Multiple Vulnerabilities in Microsoft Products · CIAD-2026-0047
CERT-In advisory CIAD-2026-0047 · 14 Oct 2026
Official title
CIAD-2026-0047 : Multiple Vulnerabilities in Microsoft Products
Official record
Open source pageSummary
Check the official recordWhat changed
CERT-In reports multiple vulnerabilities in Microsoft products that allow attackers to gain elevated privileges or execute arbitrary code. Attackers can also obtain sensitive information, bypass security restrictions, conduct spoofing, tamper with data, or cause denial-of-service conditions. The vulnerability CVE-2026-96951 in Microsoft Windows Shell allows command injection and is currently under active exploitation. IT administrators and users must apply the security updates provided by Microsoft immediately to mitigate these risks. The affected software includes Microsoft Windows, Office, Dynamics, SQL Server, Azure, and various developer tools. Users should consult the Microsoft Security Update Guide for the complete list of affected products and specific patch instructions.
What you must do
- Apply appropriate security updates as mentioned in the Microsoft security update guide.
Key dates
- Original Issue Date
- 14 Oct 2026
Document text
CERT-In Advisory CIAD-2026-0047
Multiple Vulnerabilities in Microsoft Products
Original Issue Date: October 14, 2026
Severity Rating: High
Software Affected
Microsoft Windows
Microsoft Office
Microsoft Dynamics
SQL Server
Extended Security Updates (ESU) for legacy Microsoft products
Azure
Apps
Developer Tools
Open Source Software
Server Software
System Center
ASP.NET Core
Microsoft Azure
.NET
Skype for Business Server
Linux components
Overview
Multiple vulnerabilities have been reported in Microsoft products that could allow an attacker to gain elevated privileges, obtain sensitive information, execute arbitrary code remotely, bypass security restrictions, conduct spoofing attacks, perform tampering of data or system processes, or cause denial-of-service (DoS) conditions.
Target Audience:
Individuals and IT administrators, security teams responsible for maintaining and updating Microsoft products.
Risk Assessment:
Risk of remote code execution, system instability or sensitive information disclosure.
Impact Assessment:
Potential compromise of system, exfiltration of data, ransomware attacks or system crashes.
Description
Multiple vulnerabilities have been reported in Microsoft products that could allow an attacker to gain elevated privileges, obtain sensitive information, execute arbitrary code remotely, bypass security restrictions, conduct spoofing attacks, perform tampering of data or system processes, or cause denial-of-service (DoS) conditions.
CVE-2026-96951
: This vulnerability exists in Microsoft Windows Shell due to improper neutralization of special elements used in a command (command injection). An unauthenticated attacker could exploit this vulnerability over a network by convincing a user to interact with a specially crafted file, thereby bypassing security features and potentially executing arbitrary commands on the affected system.
Note: This vulnerability is being exploited in the wild. Users are advised to apply patches immediately.
For complete list of affected products, CVEs, workarounds and solutions, refer to the Microsoft security updates.
https://msrc.microsoft.com/update-guide/releaseNote/2026-Oct
Solution
Apply appropriate security updates as mentioned in
https://msrc.microsoft.com/update-guide/releaseNote/2026-Oct
Vendor Information
Microsoft
https://msrc.microsoft.com/update-guide/
References
https://msrc.microsoft.com/update-guide/releaseNote/2026-Oct
Source details
- Source
- Indian Computer Emergency Response Team
- Type
- advisory
- Published by source
- 14 Oct 2026
- Document number
- CIAD-2026-0047
- Issuing division
- CERT-In
- Coverage area
- cybersecurity