Microsoft’s October 2026 security update, released on Tuesday 13 October, fixes a flaw in Windows that attackers were already exploiting before a fix existed. Microsoft says the bug, tracked as CVE-2026-96951, lets an attacker get around Mark of the Web, a Windows safety feature that warns you about files that came from the internet [1]. The US Cybersecurity and Infrastructure Security Agency (CISA) added it to its list of actively exploited vulnerabilities the same day [2].
What the flaw is
Microsoft calls it a “Windows Shell Security Feature Bypass Vulnerability” [1]. The Windows Shell is the part of Windows you use to open files and folders, including File Explorer and the desktop.
In Microsoft’s words, the flaw is an “improper neutralization of special elements used in a command (‘command injection’) in Windows Shell” that “allows an unauthorized attacker to bypass a security feature over a network” [1]. Microsoft says “an attacker who successfully exploited the vulnerability could evade Mark of the Web (MOTW) defenses” [1].
Mark of the Web is a hidden label Windows puts on files you download or receive. It is what triggers the “Are you sure?” warnings and Protected View in Office. If an attacker can strip or dodge that label, a dangerous file can open without the usual warning.
How an attack works
Microsoft says that in an email or chat attack, “the attacker could send the targeted user a specially crafted file” [1]. The attacker cannot force it to work on their own: “an attacker would have to convince a user to take action”, such as clicking a link or opening an attachment [1].
Microsoft marks the flaw as “Exploited: Yes” and “Exploitation Detected”, and says it was not publicly disclosed before the fix [1]. Microsoft rates it Important; the CVSS 3.1 base score is 8.8 out of 10, according to NVD [3]. Microsoft has not said who is using it or against whom.
Microsoft credits the researchers “yhw”, “Benoit Sevens using Claude with Anthropic”, and Riku Bamba and Yuya Chudo of Fujitsu Limited for reporting it [1].
Who is affected
According to Microsoft, affected systems include Windows 10 (versions 1607, 1809, 21H2 and 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H1 and 26H2) and Windows Server 2012 R2, 2016, 2019, 2022 and 2025 [1]. Outlook.com is also listed.
CISA’s deadline
CISA describes the bug as a flaw in which “Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network” [2]. It has told US federal civilian agencies to fix it by 16 October 2026. CISA says it is not known whether ransomware gangs are using it [2].
Last update for some Windows 11 PCs
This month also marks the end of the road for some PCs. Microsoft said: “Today, October 13, 2026, Windows 11, version 24H2 Home and Pro, and Windows 10 Enterprise LTSB 2016 have reached end of updates. The October 2026 monthly security update is the last update available for these editions” [4]. If you are on Windows 11 24H2 Home or Pro, install this update and then move to a newer version of Windows 11 so you keep getting fixes.
What you should do
- Install the October 2026 update now. Open Settings, go to Windows Update and select “Check for updates”. Restart when asked.
- Be careful with unexpected files and links, especially in email or chat, even from people you know. This attack needs you to open something.
- Businesses should prioritise this patch across Windows PCs and servers, given that it is already being exploited.
- On Windows 11 24H2 Home or Pro? Upgrade to a newer Windows 11 version after installing this update, because no more security updates are coming for 24H2 on those editions.
Related stories
- Attackers Are Exploiting an Ivanti Connect Secure Zero-Day, and CISA Gives US Agencies Until 16 October to Act
- SonicWall Attack Attempts, a $1.26m Pwn2Own and a Windows Update Deadline
- Meta Says Hackers Used an Employee’s Stolen Login to Get Into Its GitHub Code, and Is Notifying About 1,500 People
Sources
- Microsoft Security Response Center, “CVE-2026-96951: Windows Shell Security Feature Bypass Vulnerability”, 13 October 2026. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951
- CISA, Known Exploited Vulnerabilities Catalog, entry for CVE-2026-96951, added 13 October 2026. https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- NIST National Vulnerability Database, CVE-2026-96951. https://nvd.nist.gov/vuln/detail/CVE-2026-96951
- BleepingComputer, “Microsoft: Windows 11 24H2 Home and Pro reached end of support”, 13 October 2026, quoting Microsoft’s Windows message center. https://www.bleepingcomputer.com/news/microsoft/microsoft-windows-11-24h2-home-and-pro-reached-end-of-support/
