Microsoft Patches Actively Exploited Windows Zero-Day CVE-2026-96951: What to Do Now

On October 13, Microsoft released updates that fix CVE-2026-96951, an actively exploited vulnerability in Windows Shell. For organizations running affected systems, this is the most urgent fix in the October release. Attacks have been confirmed, so this patch should go to the front of the deployment queue.

What was fixed

The flaw lets attackers bypass a security feature. BleepingComputer reports that it has been used to get around Mark of the Web, the label Windows applies to files downloaded from the internet. The Microsoft announcement cited here does not describe the campaign or say who is behind it.

So no specific threat group, attack scale or confirmed Polish victims should be attributed to this case. What is known is that exploitation is not just theoretical, and a patch is already out.

The October release fixes other vulnerabilities as well. With a release this large, the key job for administrators is to map the threats to what the company actually runs: the products it has installed, the services it exposes and how its employees work.

Who is affected

According to KrebsOnSecurity, CVE-2026-96951 affects Windows 10, Windows 11 and some Windows Server editions. Check the Microsoft Security Update Guide for the exact list of affected versions and the matching updates. Knowing which operating system a device runs is not enough to tell whether it is already protected.

Also on October 13, Microsoft published an experimental way to group vulnerabilities around shared questions about a company’s environment. For example, administrators can assess flaws related to document handling or remote access together. Microsoft stresses that this grouping does not replace assessing each CVE individually or its existing update guidance.

What to do now

• Check the Microsoft Security Update Guide to see which of your system versions are affected by CVE-2026-96951 and which updates fix them.
• Treat the patch rollout as high priority, while allowing for any required compatibility testing and a way to roll systems back if needed.
• Confirm the update is installed on every device, including remote employees’ computers. Set a separate deadline for machines that were powered off or off the corporate network.
• Make sure all required restarts have completed, then check the security status again.
• Review alerts about suspicious files and program executions. The update removes the vulnerability, but it can’t tell you whether an incident already happened.

SecurHUB’s take

Patch priority should depend on whether a vulnerability is confirmed as exploited and how much it matters to your specific infrastructure. Security audits help you assess your patching process and pinpoint devices whose security status needs a closer look.

Sources: Microsoft MSRC, BleepingComputer, KrebsOnSecurity