A crafted file sent by email or chat can skip the warning Windows normally puts on downloads. Microsoft says attackers are already doing this, and the October 2026 update is the fix.

What happened

On 13 October 2026 Microsoft shipped its October security updates, including a fix for CVE-2026-96951, a Windows Shell security feature bypass. Microsoft rates it Important, scores it CVSS 8.8, and marks it Exploitation Detected. CISA added it to the Known Exploited Vulnerabilities catalog the same day, with a federal due date of 16 October 2026.

The flaw is a command-injection bug in Windows Shell. A successful attack lets a file evade Mark of the Web, the tag that tells SmartScreen and Office Protected View to treat a download as untrusted. Microsoft says an attacker cannot force someone to open the file. They have to deliver it, typically by email or instant message. Microsoft has not named the attacker or described the campaign.

Who is affected

Any supported Windows client or server that has not installed the October cumulative update is in scope. The user still has to open the file, so laptops that read email are the practical target.

• Windows 10 and Windows 11, including 24H2, 25H2 and 26H2, before the October 2026 cumulative.
• Windows Server 2016, 2019, 2022 and 2025, plus older supported branches, before the matching October rollup.
• Windows 10 machines outside Extended Security Updates do not receive this fix. Those hosts stay exposed.

What to do now

Install the October 2026 cumulative update and reboot, starting with machines people use for email.

• Windows 11 24H2, 25H2 and 26H2: KB5127648.
• Windows 11 23H2: KB5126653. Windows 10 21H2 and 22H2 on ESU: KB5126657.
• Windows Server 2025: KB5126646. Windows Server 2022: KB5126655. Server 2019: KB5126651. Server 2016: KB5126868.
• Confirm the build after reboot. A machine still below the fixed build for its branch is not done.
• Treat unexpected attachments as hostile until the update is on the endpoint that will open them.

What this means for South African businesses

Almost every small business we support runs Windows on the machines that open supplier invoices and bank emails. A Mark of the Web bypass does not own the PC by itself, but it removes the prompt that usually stops a staff member from launching a malicious file. That is the step ransomware and invoice-fraud kits rely on. CISA's 16 October deadline is a US federal date, not a South African one, but the exploitation flag is already set, so waiting for a quieter week is the wrong call.

Source: BleepingComputer, Microsoft October 2026 Patch Tuesday. Vendor record: Microsoft Security Update Guide. KEV entry: CISA Known Exploited Vulnerabilities Catalog.