Microsoft released security updates on October 13, 2026, fixing an actively exploited Windows Shell vulnerability tracked as CVE-2026-96951. Microsoft confirmed that attackers used the flaw before patches became available. The security feature bypass affects Windows systems and can weaken protections against malicious files delivered to users.

The fix arrived in the October Patch Tuesday release. The Center for Internet Security said the broader update covers Windows, Office, SharePoint Server, Exchange Server and other Microsoft products. Its advisory independently relayed Microsoft's confirmation of exploitation of the Shell flaw, making that vulnerability a priority within the monthly release.

Microsoft's CVE record describes a command-injection weakness in Windows Shell that allows an unauthorized attacker to bypass a security feature over a network. It assigns a CVSS score of 8.8 and indicates that exploitation requires user interaction but no prior privileges. The classification is a security feature bypass; it should not be confused with a separate, interaction-free remote code execution flaw.

According to CrowdStrike's analysis, exploitation bypasses Mark of the Web protections, which help trigger warnings or restricted handling for files downloaded from untrusted locations. An attacker can deliver a specially crafted file through email, instant messaging or a web download, but the recipient must open or click the malicious content. SANS Internet Storm Center also reported that the victim must open the file.

CrowdStrike said the bypass can undermine defenses that depend on the Mark of the Web tag, including SmartScreen and Office Protected View. This reduces a protective barrier between file delivery and subsequent malicious activity. The cited Microsoft release notice confirms exploitation but does not identify the attackers, affected organizations or the number of compromised systems.

Microsoft urged customers to apply the security updates promptly and consult its Security Update Guide for current product-specific information. The Center for Internet Security recommended installing applicable patches immediately after appropriate testing. Microsoft also directed administrators to the relevant support articles for known update issues, giving defenders deployment guidance alongside the fixes.