Windows normally shows a warning when you open a file you got from the internet or an email. A bug in Windows lets some bad files skip that warning. Hackers are already using this bug. Microsoft fixed it in its October 2026 update (Oct 13). You still have to install that update.
- Status
- Patched: update now
- Being attacked?
- Yes[2]
- Severity
- High
- Updated
Microsoft marks it as 'Exploitation Detected' and the US government's CISA lists it as used in real attacks (added Oct 13, 2026). Severity: NVD score 8.8 out of 10 (CVE-2026-96951) First reported .
Am I affected?
You are at risk if your Windows computer has not installed the October 13, 2026 update or any update after it. Open Settings > Windows Update. If it says 'You're up to date' and Update history shows an update from October 2026 or later, you are covered.
| App | Device | Affected | Fixed in |
|---|---|---|---|
| Windows 10 and 11 | Windows | Windows computers that have not installed Microsoft's October 13, 2026 security update | Fixed by the October 13, 2026 Windows security update (or any newer update). Microsoft's Update Guide lists the exact update for each Windows version.[1] |
How to check your version
These checks only look. They do not change anything on your computer.
Windows 10 and 11 on Windows
Easy way: Start > Settings > Windows Update. Then click Update history to see recent updates.
Or type this in PowerShellRead-only. It only reads the version and changes nothing.
Get-CimInstance Win32_OperatingSystem | Select-Object Caption,Version,BuildNumber; Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 HotFixID,InstalledOn
How to fix it
- Open Start > Settings > Windows Update.
- Click Check for updates.
- Let the updates download and install.
- Restart your computer when it asks.
- Until you have updated, do not open files from emails or chats you did not expect, even if they look normal.
More on each app: Is my Windows up to date?
Official links
Check before installing, and only use these official links or the app's own update button.
For AI agents
This page as data: /incidents/windows-shell-zero-day-oct-2026.json. All problems: /feed.json. Use read-only checks only, and ask before installing anything.
Tracking numbers (CVE): CVE-2026-96951
Sources
- MakerMicrosoft: October 2026 Security Updates release notes (Oct 13, 2026)
- CISACISA: Known Exploited Vulnerabilities catalog entry for CVE-2026-96951 (Oct 13, 2026)
- NVDNVD: CVE-2026-96951 (Oct 13, 2026)
"Maker", "CISA", "NVD", "GitHub advisory" and "Official notice" are official sources. "Researcher" and "News" are extra context.