Microsoft October 2026 patches: exploited Windows Shell vulnerability CVE-2026-96951, Exchange and Office to update

The short answer: Microsoft’s 13 October 2026 security updates fix CVE-2026-96951, a Windows Shell flaw that Microsoft reports as exploited. It bypasses Mark of the Web, the warning that normally accompanies a file downloaded from the internet. CISA added it to its catalogue of exploited vulnerabilities the same day, and the DGSSI’s maCERT asks organisations to fix it as a priority. Every business should install the October cumulative update on all Windows PCs and servers, then deal with Exchange, Outlook and Office, which receive several critical fixes this month.

In the Moroccan SMBs we support, Windows PCs are the norm, and staff receive attachments from customers, suppliers and public bodies every day. A flaw that strips the security warning from a malicious file therefore hits day-to-day work directly. This alert brings together what Microsoft, CISA and maCERT say, and the checks to run.

What is affected

CVE-2026-96951 (Windows Shell, security feature bypass): according to Microsoft, a command injection in Windows Shell lets an unauthenticated attacker bypass a security feature over a network. The vendor’s scenario involves a crafted file sent by email or instant message, or a link to an attacker-controlled site: the user has to be persuaded to open the file or click. The flaw then lets the attacker evade Mark of the Web defences.

Every Windows version still listed by Microsoft is affected, PCs and servers alike. On 26 October, Microsoft added Microsoft Edge to the table of products to update.

Product	Affected versions	Fixed version
Windows 11 24H2 / 25H2 / 26H2	builds before 26100.9711 / 26200.9711 / 26300.9711	KB5127648
Windows 11 26H1	builds before 28000.3231	KB5127646
Windows 11 23H2	builds before 22631.7652	KB5126653
Windows 10 21H2 / 22H2	builds before 19044.7807 / 19045.7807	KB5126657
Windows Server 2025	builds before 26100.33650	KB5126646
Windows Server 2022	builds before 20348.5761	KB5126655
Windows Server 2019 and Windows 10 1809	builds before 17763.9376	KB5126651
Windows Server 2016 and Windows 10 1607	builds before 14393.9612	KB5126868
Windows Server 2012 R2	builds before 9600.23470	KB5126836 (Monthly Rollup)
Microsoft Edge	versions before 154.0.4258.62	154.0.4258.62

Source: Microsoft Security Update Guide (MSRC), CVE-2026-96951 entry, revision of 26 October 2026.

Severity and exploitation

• Published severity: Microsoft rates the flaw “Important” with a CVSS 3.1 base score of 8.8, also shown by NVD.
• Exploitation: Microsoft marks it “Exploitation Detected”. CISA added it to its KEV catalogue on 13 October 2026, with a 16 October deadline for US federal agencies and a forensic triage requirement. maCERT states in bulletin 69481410/26 of 14 October that the vulnerability is being actively exploited.
• Workaround: Microsoft’s entry offers none. Only the update protects you.

Other fixes not to miss this month

The October release is a record in volume according to the specialist press. Several critical flaws, not reported as exploited, matter directly to SMBs:

• Exchange Server, CVE-2026-70571: remote code execution through a crafted email, with no authentication or user action, rated critical and “Exploitation More Likely” by Microsoft. Updates ship for Exchange Server Subscription Edition (KB5128895), 2019 CU15 (KB5128896), 2019 CU14 (KB5128897) and 2016 CU23 (KB5128898). maCERT covers it in bulletin 69501410/26.
• Outlook, CVE-2026-70242: code execution from a message simply displayed in the Reading Pane, scored 9.8 by Microsoft. Fixed in Office LTSC 2024 (build 16.0.17932.21056), LTSC 2021 (16.0.14334.20974) and Microsoft 365 Apps.
• PowerPoint, CVE-2026-88178: code execution through a crafted presentation processed by an Office Online service, without authentication, scored 9.8.
• SharePoint Server Subscription Edition, CVE-2026-102866: privilege escalation through a modified token, fixed by KB5002927.

maCERT grouped the Office, SharePoint and Office Online Server flaws in bulletin 69471410/26, rated critical risk.

Checks to run

1. Check each machine’s actual build: with winver or in your management tool’s inventory, compare the build number with the table above. An update downloaded but waiting for a restart does not protect you.
2. Restart servers: schedule a maintenance window for domain controllers, file servers and application servers, which are often postponed.
3. Check roaming laptops: devices that rarely come back to the office only get updates if a management tool such as Microsoft Intune is in place.
4. Update Microsoft Edge and Office: check the Edge version and the Microsoft 365 Apps update channel; for Office LTSC, check the installed build.
5. Prioritise on-premises Exchange: install the update matching your CU, then check the build reported by the server.
6. Tighten attachment filtering: until the whole fleet is up to date, block file types your business does not need at the email gateway and remind staff to be wary of unexpected attachments. Our article on phishing scams targeting SMBs in Morocco gives concrete examples.
7. Look for traces: suspicious file openings, unusual processes launched from Explorer, and antivirus or EDR alerts since 13 October.

Our view for businesses in Morocco

This month’s exploited flaw does not target an exposed server: it targets the user and their inbox. The two riskiest situations we see are the unmanaged fleet, where nobody knows which PCs have actually restarted, and the on-premises Exchange server maintained “when there is time”. The 10 settings to secure Microsoft 365 reduce the attack surface on the email side, and a managed EDR with 24/7 monitoring spots abnormal behaviour even when the security warning has been bypassed. For organisations in scope, Law 05-20 and DGSSI requirements also require these bulletins to be acted on.

How we can help

As a Microsoft partner, we roll out monthly updates to your PCs and servers, check the builds actually installed, update Exchange and Office, and provide 24/7 monitoring with critical incidents handled in under 15 minutes. Read about our approach to business cybersecurity in Morocco, then request your free initial audit: we reply within 24 business hours.

Sources: Microsoft Security Update Guide, CVE-2026-96951, CVE-2026-70571, CVE-2026-70242, CISA KEV catalogue, NVD CVE-2026-96951, maCERT Windows bulletin, maCERT Exchange bulletin, maCERT Office bulletin.