Microsoft's October Patch Tuesday, its largest yet, fixes CVE-2026-96951: an actively exploited Windows Shell flaw that lets internet files open without SmartScreen or Office warnings. It affects any business running Windows. Install the October updates this week, starting with the machines that receive email and download files.
Key facts
- On 13 October 2026 Microsoft fixed 1,413 CVEs, according to SecurityWeek, Dark Reading and The Hacker News. BleepingComputer counts 1,411 because it only includes those published that day. September had 974.
- CVE-2026-96951 (CVSS 8.8) is a command injection flaw in Windows Shell that lets an attacker bypass a security feature over the network. Microsoft confirms active exploitation.
- CISA added it to its KEV catalogue on 13 October, with a 16 October deadline for US federal agencies.
- A second zero-day, CVE-2026-108398 (CVSS 8.8), was already publicly disclosed: a .NET Framework flaw that bypasses Windows Defender Application Control (WDAC). It needs local access and Microsoft rates exploitation as unlikely.
- On 13 October Windows 11 24H2 Home and Pro and Windows 10 Enterprise LTSB 2016 reached end of support. This is their final update.
Why does this flaw matter so much?
Windows tags every file that comes from the internet with the Mark of the Web (MotW). That tag is what triggers the warnings your staff already know: 'this file might be harmful', Protected View in Word or Excel, macro blocking.
CVE-2026-96951 makes that tag irrelevant. According to Automox's analysis, it disables SmartScreen, Office Protected View, Office macro blocking, Smart App Control and the Attachment Manager warning. A document, archive or shortcut received by email opens as if it were trusted.
Microsoft hasn't said how it is exploited, by whom or against whom. It was reported by researchers at Fujitsu, at Anthropic and by an independent researcher. The lack of detail doesn't lower the risk: exploitation is confirmed.
Am I affected if my machines run Windows 11 24H2?
Yes, twice over. Like any Windows machine, they need the October patch. And if they run Home or Pro, this patch is the last they'll get. From now on, every new flaw discovered will stay open on those devices.
It's common in small businesses: laptops bought off the shelf with Windows Pro that nobody has upgraded. They need moving to a supported version, just like any Windows 10 still running without ESU.
Do I have to swallow 1,400 patches at once?
You won't review them one by one, and you don't need to. Windows cumulative updates install them together. What changes is the order: with this volume, your IT provider needs to know what goes first.
This month Microsoft introduces experimental 'risk cohorts' to help prioritise. For example, it groups 135 flaws in Office documents and email clients, and 136 in Windows file systems, storage and backup. Useful, but the top of the list is clear: CVE-2026-96951.
What to do today
- Deploy the October updates to every Windows PC and server this week. Start with machines that receive email and download files, and with admin and finance.
- Check in Windows Update, Intune or your RMM that they have actually been applied, not just scheduled.
- Warn staff today: until the patch is installed, don't open unexpected attachments or downloads, even if no 'protected' warning appears.
- Inventory machines running Windows 11 24H2 Home or Pro and plan their move to a supported version.
- Ask your IT or managed security provider to confirm patch status in writing and that CVE-2026-96951 has been prioritised.
What it means for a small business
This flaw hits exactly the protection layer a small company without a security team relies on most: the automatic warnings in Windows and Office. If your phishing defence is 'everyone knows not to touch it when the yellow banner shows up', that rule doesn't hold this week.
CISA gives federal agencies three days. That isn't a rule for you, but it's a good yardstick: if the patch isn't deployed by the end of the week, you're late.
The 24H2 Home and Pro issue is less urgent but more awkward. An unpatched machine is a problem that grows every month. If you don't know how many you have, that's the first number you need. If you want help sorting out patching and inventory, see how we work in cybersecurity.
FAQ
Isn't antivirus enough?
No. The flaw disables Windows and Office warnings that depend on the Mark of the Web. The fix is installing the October update.
What about the second zero-day, in .NET Framework?
It's also fixed by the October updates. It requires local access and Microsoft rates exploitation as unlikely, so it ranks behind CVE-2026-96951.
Will my Windows 11 24H2 Home or Pro machines stop working?
No, they keep working, but they won't receive security patches any more. Move them to a supported version.
Sources
- CISA – CISA Adds Two Known Exploited Vulnerabilities to Catalog
- BleepingComputer – Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days
- SecurityWeek – Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day
- Dark Reading – Zero-Days Lurk in Microsoft's Overgrown October Patch Tuesday
- The Hacker News – Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug
