Skip to content

Windows Shell zero-day CVE-2026-96951: check October update

Microsoft's October 2026 Windows security update (13 October) fixed CVE-2026-96951, a Windows Shell flaw that lets a crafted file evade Mark of the Web protection; Microsoft marks it "Exploited: Yes" and CISA added it to its Known Exploited Vulnerabilities catalog the same day. Every Windows estate should confirm that all devices run the October cumulative update or later, because November's Patch Tuesday on 10 November will only help devices that are still updating.

Runbook card

What changes: nothing new this week. This is an exploited zero-day from 13 October that is easy to have missed, and we missed it in our own coverage until today.
Who: every Windows version in the table below, Windows 10 and 11 and Windows Server 2012 R2 to 2025, on any device without the October 2026 cumulative update.
By when: now. CISA's federal due date was 16 October 2026 and has passed.
Do this: 1. Confirm the October 2026 cumulative update (or any later one) on every device, using the KB and build table below. 2. Chase the devices that are not reporting or are stuck. 3. Update Microsoft Edge to 154.0.4258.62 or later. 4. Our advice: keep Defender attack surface reduction rules and SmartScreen on, since they work alongside Mark of the Web.
Check: the OS build on each device is at or above the fixed build for its version, or Defender Vulnerability Management shows no exposed devices for CVE-2026-96951.
Source: MSRC Security Update Guide: CVE-2026-96951 (13 October 2026, revised 26 October 2026) and the CISA KEV catalog.

What Microsoft says

The Security Update Guide titles CVE-2026-96951 "Windows Shell Security Feature Bypass Vulnerability": "Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network." CVSS 8.8, severity "Important", "Exploited: Yes", "Publicly disclosed: No".

Microsoft's FAQ names the protection that falls: "An attacker who successfully exploited the vulnerability could evade Mark of the Web (MOTW) defenses." Mark of the Web is the tag Windows puts on files from the internet; it is what triggers SmartScreen checks, Protected View in Office and the macro block on downloaded documents.

The attack needs a user. Microsoft: "In an email or instant message attack scenario, the attacker could send the targeted user a specially crafted file that is designed to exploit the vulnerability", and "an attacker would have to convince a user to take action", such as clicking a link or opening an attachment. That makes it a phishing tool: the file arrives without the warning users have learned to expect.

On 26 October Microsoft revised the entry: "Added Edge software to the Security Updates table", with Microsoft Edge (Chromium-based) 154.0.4258.62 listed as the fixed version. Outlook.com is listed too; it is a Microsoft-run service, so there is nothing for you to install.

Microsoft has not said who exploited the flaw or against whom.

Fixed builds (October 2026 cumulative update)

Windows version KB Fixed build
Windows 11 version 26H1 KB5127646 10.0.28000.3231
Windows 11 version 26H2 KB5127648 10.0.26300.9711
Windows 11 version 25H2 KB5127648 10.0.26200.9711
Windows 11 version 24H2 KB5127648 10.0.26100.9711
Windows 11 version 23H2 KB5126653 10.0.22631.7652
Windows 10 version 22H2 KB5126657 10.0.19045.7807
Windows 10 version 21H2 KB5126657 10.0.19044.7807
Windows 10 version 1809, Windows Server 2019 KB5126651 10.0.17763.9376
Windows 10 version 1607, Windows Server 2016 KB5126868 10.0.14393.9612
Windows Server 2025 KB5126646 10.0.26100.33650
Windows Server 2022 KB5126655 10.0.20348.5761
Windows Server 2012 R2 KB5126836 6.3.9600.23470

Windows cumulative updates include earlier fixes, so any later cumulative update also fixes CVE-2026-96951. Server Core installations use the same KB as the full edition.

CISA's listing

CISA added CVE-2026-96951 to the KEV catalog on 13 October 2026 as "Microsoft Windows Command Injection Vulnerability", with a federal due date of 16 October 2026 and the flag for forensic triage. Known ransomware use: "Unknown".

If you skipped September too: CISA added two other Windows flaws on 8 September 2026, CVE-2026-81963 ("Microsoft Windows Link Following Vulnerability", Windows Update Stack, local privilege escalation to SYSTEM) and CVE-2026-85880 ("Microsoft Windows Heap-Based Buffer Overflow Vulnerability", Advanced Local Procedure Call), both with a federal due date of 22 September 2026. Windows cumulative updates carry earlier months' fixes, so a device on the October build should have them too; confirm it by searching Defender Vulnerability Management for each CVE.

How to check (read-only)

On a single device, compare the build and update revision with the table:

$cv = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
"{0} build {1}.{2}" -f $cv.DisplayVersion, $cv.CurrentBuildNumber, $cv.UBR

For example, Windows 11 24H2 needs build 26100.9711 or higher. A device on 26100.9600 is missing the October update.

Across the estate:

  • Defender Vulnerability Management: Microsoft Defender portal, Vulnerability management, Weaknesses, search for CVE-2026-96951 and open Exposed devices. This only covers onboarded devices with a healthy sensor (control DE01).
  • Intune: Intune admin center, Reports, Windows updates, and the quality update report for your update ring or policy; look for devices that failed or have not reported since 13 October.
  • WSUS or Configuration Manager: the compliance view for the October 2026 cumulative update of each OS.

How to verify

Each device reports a build at or above the table, Defender Vulnerability Management lists no exposed devices for CVE-2026-96951 (and for CVE-2026-81963 and CVE-2026-85880), and Edge reports 154.0.4258.62 or later on edge://version.

What else helps

Our advice, not Microsoft's guidance for this CVE: keep Defender attack surface reduction rules in block mode, starting with the standard protection rules (control DE04), and test the rules that stop Office apps and email clients from launching executable content; keep SmartScreen on, and keep blocking risky attachment types at the mail gateway. Users who receive a file with no "downloaded from the internet" warning should not be your last line of defence.

Impact and rollback

This is the standard monthly cumulative update. If a device has not installed it by now, the cause is usually an update ring that is paused, a failed install or a device that is offline; fix that rather than rolling back. If you must uninstall it for a known issue, remember the November update on 10 November replaces it and carries the same fix.

Related: the .NET and PowerShell 7 Brotli update that is also in KEV with a 10 November due date, the Defender for Endpoint and ASR kit, dated actions on Microsoft 365 security deadlines, and more Endpoint & devices news.

Sources

Last reviewed: 4 November 2026. Runbook Lab is not affiliated with Microsoft.