Skip to contentistheinternetok
All incidents

Security flaw·Major

Windows: zero-day used to skip download warnings

Fix availableAttackers already use itAffects everyone
Windows

What it changes for you

A harmful download could open without Windows warning you.

Attackers were using a Windows flaw to get around the warning Windows shows for files downloaded from the internet. Microsoft fixed it in the October updates; install them.

Started Oct 13, 2026Updated Oct 13, 2026

Post on X

What should I do?

You
Install the October 2026 Windows updates (Settings, Windows Update).
If you run a website or an app
Deploy the October 13, 2026 Patch Tuesday updates; CVE-2026-96951 is in CISA's Known Exploited Vulnerabilities catalog.

What is affected

CVE-2026-96951

Timeline

  1. Fix available · Oct 13, 2026

    CISA adds CVE-2026-96951 to its Known Exploited Vulnerabilities catalog.

    CISA

  2. Fix available · Oct 13, 2026

    Microsoft's October Patch Tuesday fixes CVE-2026-96951, a Windows Shell security feature bypass of Mark of the Web, exploited in attacks.

    BleepingComputer

Sources