74 openlast updated

HomeOctober 2026 patch cycleCVE-2026-96951: exploited Windows Shell zero-day

Patch nowEnterpriseEnd-user appsfrom 2026-10

CVE-2026-96951: exploited Windows Shell zero-day

Part of October 2026 patch cycle

Vendor
Microsoft
Products
Windows 11 24H2/25H2/26H2, Windows 11 23H2, Windows 10 21H2/22H2, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025
Published
Status
Open

Call: Patch now. CVE-2026-96951 is a Windows Shell Mark-of-the-Web bypass, and it’s being exploited. Microsoft says so, and CISA added it to KEV on October 13 with a due date of October 16. That date has passed. If a machine is still on September’s build, it’s the one to look at first.

What breaks: For the attacker, Mark-of-the-Web. A crafted file or link gets past the “this came from the internet” checks, so SmartScreen and Protected View don’t get their say. It needs a user to open something, which, historically, has not been a high bar. CVSS 8.8. Microsoft hasn’t published exploitation details, and neither has anyone else we could find.

Who’s hit: Every supported Windows client and server. The fixes:

  • KB5127648: Windows 11 24H2, 25H2 and 26H2
  • KB5126653: Windows 11 23H2
  • KB5126657: Windows 10 21H2/22H2
  • KB5126646: Windows Server 2025
  • KB5126655: Windows Server 2022
  • KB5126651: Windows Server 2019
  • KB5126868: Windows Server 2016

Windows 11 24H2 Home and Pro reached end of updates with this release. This is the last fix they get, so the next exploited Shell bug won’t be patched on them at all.

Workaround: None. Install it. The update has side effects, but they hit specific roles, so handle them by role instead of holding the whole estate:

  • On-prem Exchange servers run out of RPC Endpoint Mapper contexts. Set EpmapSavedContextCap before you patch.
  • PEAP-MSCHAPv2 Wi-Fi that relies on Windows-logon SSO stops working (NTLMv1 SSO is now blocked by default).
  • Non-admin RDP fails with 0xC000000D on hosts with Administrator protection.
  • Always On VPN with automatic protocol selection is still broken. The fix Microsoft announced was withdrawn.
  • Smart App Control can’t be turned back on.
  • Boot failures and install rollbacks on some hardware, mostly Dell. These are reported, not confirmed by Microsoft. Pilot by model.

Check compliance by OS build, not by what Windows Update claims. A rolled-back install leaves the machine on the old build and still exposed.

Sources: BleepingComputer, SecurityWeek, KB5127648 release notes, isMalicious KEV tracker.

Sources

More from October 2026 patch cycle