Microsoft’s October 2026 security update fixes an actively exploited Windows zero-day. The vulnerability, CVE-2026-96951, affects Windows Shell and can be used to bypass the Mark of the Web security feature.
Microsoft’s October Patch Tuesday also fixes two other publicly disclosed zero-days and a very large number of additional vulnerabilities across Windows, Office, .NET, Azure and other Microsoft products.
For businesses, the key action is straightforward: make sure supported Windows devices receive the October security updates promptly, restart where required, and check that patching is completing successfully across managed endpoints.
What is CVE-2026-96951?
CVE-2026-96951 is a Windows Shell security feature bypass vulnerability. Microsoft says the flaw can allow an unauthorised attacker to bypass a security feature over a network.
The important point is that Microsoft has confirmed the vulnerability was already being exploited before the October 2026 updates were released.
The flaw can bypass Mark of the Web, a Windows protection that helps identify files downloaded from the internet or other untrusted locations so Windows and Microsoft applications can apply additional warnings and restrictions.
Microsoft has not published details of how the vulnerability was exploited in the attacks it observed.
What did Microsoft fix in the October 2026 security update?
Microsoft’s October Patch Tuesday addresses a record-breaking number of vulnerabilities across its product range. Security researchers counted 1,411 vulnerabilities released as part of the October Patch Tuesday cycle, including 70 rated Critical.
Those figures cover a broad range of products and vulnerability types, so businesses should not treat the total on its own as a measure of immediate risk. The most important issue for ordinary Windows environments is that one of the zero-days is already being exploited.
Microsoft also fixed two publicly disclosed zero-days:
- CVE-2026-108398 – a .NET Framework security feature bypass that can allow Windows Defender Application Control restrictions to be bypassed.
- CVE-2026-92707 – a MessagePack-CSharp denial-of-service vulnerability.
What should businesses do now?
If your organisation uses supported Windows devices, the October security updates should be treated as a priority because Microsoft has confirmed active exploitation of CVE-2026-96951.
Businesses should:
- Install the October 2026 Windows security updates on supported devices.
- Restart devices where required so updates complete properly.
- Check patch compliance rather than assuming automatic updates have succeeded.
- Investigate devices that repeatedly fail updates or remain on unsupported Windows versions.
- Make sure endpoint security and monitoring tools are still reporting correctly after patching.
Managed environments should also review whether any devices have fallen outside normal update rings, been offline for extended periods or are still waiting for a reboot.
Not sure whether every business device is actually patched?
KES can review Windows patching, endpoint security and Microsoft 365 configuration to identify devices or settings that need attention.
Does this affect Windows 11 only?
No. Microsoft’s October security release covers multiple supported Windows versions and other Microsoft products.
However, some older Windows editions reached end of support on 13 October 2026. Windows 11 24H2 Home and Pro received their final monthly security update this month, so businesses still running those editions should already be planning an upgrade to a supported release.
KES has already covered this separately in Windows 11 24H2 Support Ends in October 2026: What Businesses Need to Do.
Why Mark of the Web matters
Mark of the Web is one of the mechanisms Windows uses to treat files from untrusted locations differently from trusted local files.
When it works correctly, it can trigger warnings, Protected View or other security controls when a user opens a downloaded file. A vulnerability that bypasses that protection can reduce the number of barriers an attacker has to overcome when trying to persuade a user to open malicious content.
This does not mean every downloaded file is dangerous. It does mean a vulnerability that bypasses those protections is important enough to patch quickly when exploitation is already confirmed.
How urgent is the October update?
Businesses should not delay this month’s Windows security updates unnecessarily.
The existence of an actively exploited vulnerability means attackers are already using at least one of the flaws addressed by the update. That changes the risk from theoretical to practical.
The right approach is controlled but prompt patching: install the updates, restart affected systems, verify success and investigate failures.
If you want a wider health check alongside patching, see our Seven Microsoft 365 Checks Worth Making guide.
Quick answers
Is there an actively exploited Windows zero-day in the October 2026 update?
Yes. Microsoft says CVE-2026-96951, a Windows Shell security feature bypass, was already being exploited before the October update was released.
What is the main action for businesses?
Install the October 2026 Windows security updates on supported devices, restart where necessary and verify that patching has completed successfully.
How many zero-days did Microsoft fix this month?
Microsoft fixed one actively exploited zero-day and two other publicly disclosed zero-days in the October 2026 Patch Tuesday release.
Should businesses panic about the 1,411 vulnerability figure?
No. The raw total spans many Microsoft products and vulnerability categories. The practical priority is to patch supported systems promptly, especially because one flaw is already being exploited.
Sources
