Microsoft has quietly expanded the scope of one of the most dangerous Windows bugs of the year. On October 26, 2026, the company revised its advisory for CVE-2026-96951 — a Windows Shell flaw already being used in real-world attacks — to add Microsoft Edge to the list of affected products. That means patching Windows alone is no longer enough; your browser needs updating too.
What the flaw actually does
CVE-2026-96951 is a security-feature bypass in the Windows Shell — the part of Windows that handles the desktop, Start menu, and File Explorer. The flaw lets a crafted file sneak past the "Mark of the Web" (MOTW), the invisible tag Windows attaches to files downloaded from the internet to trigger security warnings.
In plain English: when you download a file or receive one by email, Windows normally stamps it as "from the internet" so SmartScreen can warn you, Office opens it in Protected View, and the shell shows the standard "Are you sure you want to run this?" prompt. With this bypass, SmartScreen no longer treats the file as untrusted, Office no longer routes it to Protected View, the shell may not display the origin warning, and application control policies keyed on the mark no longer apply.
According to SANS ISC, a file from email or chat can run code once opened. The bug is rated 8.8 out of 10 in severity.
Why October 30 matters: Edge is now in scope
The original fix shipped on October 13 as part of Microsoft's record-breaking Patch Tuesday. Microsoft's own Security Update Guide data for the October 2026 release, as of October 30, lists 1,474 Microsoft-assigned CVEs, 94 of them rated Critical.
But on October 26, Microsoft issued Revision 2 of the advisory. Microsoft revised its advisory for CVE-2026-96951, a Windows Shell security-feature bypass that Microsoft confirms is being exploited in the wild, to add Microsoft Edge to the affected products. That update was flagged publicly on October 30.
The one step that matters most this week is confirming that both Windows and Edge are patched for CVE-2026-96951. Many shops will already have Windows done, so Edge is the likely gap. Microsoft is specifically calling for Edge to be on version 154.0.4258.62 or later. If you've installed the October Windows update but haven't restarted Edge in a week or two, you are still exposed.
Who's affected
The exploited bug affects every Windows build Microsoft still lists: Windows 10 1607, 1809, 21H2 and 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 R2, 2016, 2019, 2022 and 2025. In other words, essentially every Windows PC and laptop in use today.
Because active exploitation has already been confirmed, CISA added CVE-2026-96951 to its Known Exploited Vulnerabilities catalog on October 13, 2026, with a remediation deadline of October 16 for applicable U.S. federal agencies. That three-day deadline tells you how seriously the government is taking this one.
Microsoft lists no workaround for the exploited bug, so the update is the fix. If a malware-laden file does slip through and encrypt your documents, you'll likely need professional help to clean the infection off the machine and, in the worst case, recover files from the affected drive.
How to check your PC today
Three quick steps:
1. Open Settings → Windows Update → Check for updates. Install anything offered, including the October cumulative update (KB5127648 on Windows 11 24H2/25H2/26H2), and restart.
2. Open Edge, click the three-dot menu → Help and feedback → About Microsoft Edge. Let it update, then relaunch the browser.
3. If Windows Update stalls, errors out, or your PC is too slow to finish the install, don't ignore it — unpatched machines are the ones currently being targeted. A stuck update is often a sign of a failing drive or low disk space, and a quick SSD or memory upgrade can both fix the install and extend the life of the machine.
What This Means for York, PA
If you're a York County home user or small business and your PC has been nagging you about updates for weeks, now is the week to deal with it — attackers are actively using this flaw against unpatched machines. If Windows Update won't finish or Edge won't launch after patching, bring the machine into our shop at 2069 Carlisle Rd and we'll get it current.
Sources
- Microsoft adds Edge to exploited Windows Shell flaw CVE-2026-96951 from October Patch Tuesday
- CVE-2026-96951: Actively Exploited Windows Shell Zero-Day Bypasses Mark of the Web
- CVE-2026-96951: The Mark-of-the-Web Bypass and the Limits of Trust-on-Download
- October 2026 Patch Tuesday: CVE-2026-96951 Exploited, KB List
- Windows Shell CVE-2026-96951: Mark of the Web Bypass Zero-Day Actively Exploited