Windows’ October update fixes a flaw attackers are already using to get past download warnings

Microsoft’s October 2026 security updates fix a Windows flaw that attackers are already using to slip files past one of Windows’ basic download protections.

The flaw, CVE-2026-96951, is in Windows Shell. Microsoft’s Security Update Guide lists it as “Exploitation Detected” and rates it Important. Microsoft says an attacker who exploits it “could evade Mark of the Web (MOTW) defenses”. The fix shipped on 13 October 2026 (US time) and arrives through Windows Update.

What Mark of the Web does

Mark of the Web is a label Windows adds to files that come from an untrusted location such as the internet. Microsoft’s guidance on macros in Office gives browser downloads and email attachments as examples. Other protections rely on that label. Office, for example, blocks macros in files that carry it, because macros are, in Microsoft’s words, “a common way for malicious actors to gain access to deploy malware and ransomware”.

On our reading, a file that gets past Mark of the Web can open without the checks Windows and Office would normally apply to something from the internet. Microsoft hasn’t said which protections the attackers in this case were trying to avoid, who was targeted or how widely the flaw has been used.

How an attack would work

Microsoft’s description is short. In an email or instant message attack, the attacker sends the target “a specially crafted file that is designed to exploit the vulnerability”. The attacker can’t force anyone to open it. They have to convince the person to act. Microsoft’s examples are getting them to click a link to the attacker’s site, or sending a malicious attachment.

That’s the familiar shape of a phishing attack: an invoice, a delivery notice or a shared document that looks routine. On our reading, the difference is that a warning which would normally appear may not.

Who it affects

Microsoft lists Windows 11 versions 23H2 to 26H2, along with Windows 10 22H2, older Windows 10 long-term servicing releases, and Windows Server 2012 R2 to 2025. Microsoft also lists Outlook.com.

For most Windows 11 PCs the fix is in KB5127648, the October update for versions 24H2, 25H2 and 26H2. Microsoft’s update data lists KB5126657 for Windows 10 22H2.

Windows 10 reached end of support on 14 October 2025. A Windows 10 home or small-office PC gets security fixes like this one only if it’s enrolled in Extended Security Updates (ESU). Microsoft’s Australian ESU page says enrolment is open until the program ends on 12 October 2027. It’s free if you sync your PC settings, or costs 1,000 Microsoft Rewards points or a one-off AU$44.95, and one licence covers up to 10 devices.

This was also the last monthly update for Windows 11 version 24H2 Home and Pro, as we reported in our story on 24H2’s end of updates. Those PCs get this fix, but they won’t get next month’s.

The rest of the October release

The October release is large. Microsoft’s update data lists more than 1,400 vulnerabilities assigned by Microsoft itself, most of them rated Important. One other Microsoft-assigned flaw, in the .NET Framework (CVE-2026-108398), had been publicly disclosed before the fix, though Microsoft’s data doesn’t mark it as exploited.

Microsoft’s security team has floated grouping vulnerabilities into “risk cohorts” to help IT teams work through releases this size. In a blog post, it stressed that this isn’t a new classification and doesn’t change its update guidance. For a small business, the guidance is simpler: install the update.

How to install it

Microsoft’s Windows update help says to open Start, then Settings, then Windows Update (on Windows 10, Update & Security, then Windows Update), select the option to check for updates, choose Download & install if anything is waiting, and restart when prompted. The fix doesn’t protect a PC until it has been installed, and many updates finish only after a restart.

Checklist

• Run Windows Update on every Windows PC. Install the October 2026 security update and restart when Windows asks.
• Include the machines nobody uses daily. Spare laptops, reception PCs and anything switched off for a while may still be waiting.
• Check each Windows 10 22H2 Home or Pro PC’s ESU enrolment. Without it, the PC doesn’t receive this fix. Look in Windows Update for the enrolment link, or plan its replacement.
• Move any Windows 11 24H2 Home or Pro PCs to a newer version. October was their last monthly update.
• Remind staff about unexpected attachments and links. This attack needs someone to open a file or click a link, so check with the sender, using contact details you already have, before opening anything you didn’t expect.
• Ask your IT provider to confirm your Windows servers have the October update. Windows Server 2012 R2 to 2025 are also listed as affected.