Microsoft patches actively exploited Windows zero-day flaw

Microsoft's October 2026 update, released on 13 October, closed a Windows flaw that attackers were already using. CVE-2026-96951 is a command injection issue in Windows Shell that defeats the operating system's Mark of the Web (MOTW) protection. The US Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalogue the same day.

Why MOTW matters

Mark of the Web is the tag Windows attaches to files that arrive from the internet or by e-mail. That tag is what makes Office documents open in Protected View, triggers a SmartScreen warning, or blocks a file from running at all. In practice it is the last warning layer between an employee and a malicious attachment.

CVE-2026-96951 lets a specially crafted file slip past that layer. According to Help Net Security, an attacker can deliver the file by e-mail, instant message, or collaboration tools such as Teams and Slack, or lure the user into downloading it from a malicious site. Exploitation still requires the user to open the file — but when they do, the warning screen they would normally rely on simply never appears.

Concretely: an employee opens what looks like a quotation or an invoice attachment, never sees the "this file came from the internet, enable editing" prompt, and the content runs. That is precisely the entry path ransomware and infostealer campaigns have leaned on for years.

The rest of the package, and what it means for SMEs

BleepingComputer reports that the October release fixes more than 1,400 vulnerabilities, a record for a single Patch Tuesday. The same source puts 70 of them at critical severity and counts three zero-days in total: one under active exploitation and two publicly disclosed. Help Net Security additionally flags a critical signature verification flaw in SharePoint (CVE-2026-102866) and 55 flaws with wormable potential.

A package this size tends to land on the "we'll get to it" shelf in smaller organisations. But the number of CVEs is not what makes this one urgent — the fact that one of them is being used in the field right now is. As Dustin Childs of Trend Micro's Zero Day Initiative put it, teams should prioritise what is proven, prioritised and public rather than triaging by CVE count.

What we recommend at Kamer Bilişim

• Complete the October update this week, then verify the rollout. A patch being released is not the same as a patch being applied. Pull an installation report from WSUS, Intune or whichever management tool you use. Machines that are switched off and laptops that have not been restarted in weeks are almost always where the gap sits.
• Strengthen the layer before the attachment is opened. If MOTW can be bypassed, that warning screen cannot be your only line of defence. Quarantining executable and macro-bearing attachments at the mail gateway, tagging messages from unknown senders, and confirming that behaviour-based protection is enabled in your endpoint security product all measurably reduce what this flaw can achieve.
• Know which build is running on which machine. You cannot prioritise patching without a current inventory. List the machines still on older branches such as Windows 10 1607 or Server 2012 R2: they need different update packages, and they are where the patch window is most often missed.

To set up a patch management process, build an endpoint inventory, or review your mail security configuration, reach us through our contact page. We provide on-site support across the Anatolian side of Istanbul and remote support elsewhere.

Source: BleepingComputer, Help Net Security, CISA Known Exploited Vulnerabilities Catalog