Attackers are already using a Windows bug Microsoft fixed on Tuesday. Get the October update onto laptops first

By George Bailey   Published: 10/14/26   5 min read
Cyber News

Microsoft’s October updates came out on Tuesday, and one of the bugs in them is already being used in attacks. It lets a booby-trapped file sent by email or chat slip past Mark of the Web, the tag that makes Windows warn people about files from the internet.

CISA added the bug to its Known Exploited Vulnerabilities catalog the same day and gave federal agencies until Friday, October 16, to patch. That is a reasonable deadline for everyone else too.

The warning that pops up before you open a downloaded file is the last thing between a phishing email and a running payload. Attackers have a way around it, and Tuesday’s update closes it.

Microsoft patches a Windows bug attackers already use

Microsoft lists the exploited bug, CVE-2026-96951, as a Windows Shell security feature bypass rated Important with a CVSS score of 8.8. Its advisory says an attacker who exploits it “could evade Mark of the Web (MOTW) defenses,” the tag Windows puts on files from the internet. The root cause is a command injection in Windows Shell. Microsoft marks it “Exploitation Detected” and has not said who is using it.

Microsoft’s FAQ spells out the delivery: the attacker sends a specially crafted file by email or instant message, or gets the user to click a link to a site they control. Someone still has to open the file or follow the link.

Two other bugs were public before the fix but are not listed as exploited:

The release is the largest Microsoft has shipped. The Zero Day Initiative counts 1,415 new Microsoft CVEs, more than in any previous full year.

Every supported Windows PC and server is on the list

The exploited bug affects every Windows build Microsoft still lists: Windows 10 1607, 1809, 21H2 and 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 R2, 2016, 2019, 2022 and 2025. Microsoft’s described attack runs through email and chat, so the laptops people read mail on come first.

Outlook is the second priority. Five Outlook bugs in this release are rated Critical at 9.8, and for each one Microsoft says that simply viewing a crafted message in the Reading Pane could trigger it, without the recipient opening anything. None is marked exploited. For two of them, Microsoft says the Office LTSC for Mac 2021 and 2024 fixes are not available yet.

Servers have their own item. A Windows DHCP Server bug, CVE-2026-96934, is rated 9.8 and needs no login or user action: one crafted packet to the service. It affects Windows Server 2012 through 2025.

Push the October update to laptops first, then Outlook and DHCP

Forward this

For whoever manages our Windows updates: Microsoft’s October release fixes a Windows bug attackers are already using to get booby-trapped files past the download warning. CISA wants it patched by Friday, October 16. Can we get the October update, and the restart, onto every laptop and server by then, starting with the machines people read email on?

Details

Hunt / verify

Slack paste: Oct Patch Tuesday: Windows Shell bug (CVE-2026-96951) is exploited, CISA due date Fri Oct 16. Push Oct cumulative updates + restarts to email laptops first, then Outlook/M365 Apps (5 critical Reading Pane bugs), then DHCP servers.

Sources

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].