Microsoft releases patch for actively exploited Windows Shell flaw

Microsoft has issued a record-breaking security update this October. This Patch Tuesday includes more than 1,400 fixed bugs in total. One specific flaw allowed attackers to use files sent through email or chat apps.

The issue involves Windows Shell and is identified as CVE-2026-96951. Opening the malicious file bypasses Mark of the Web protections that warn users of danger. Normally files from unknown sources open in read-only Protected View or are blocked entirely.

Attackers can send such a file via email, Teams, or Slack to trick users into opening it. User interaction is required before the vulnerability can be triggered. Once opened, the protections that usually block or warn about danger are bypassed.

Satnam Narang from Tenable notes this is the third Windows Shell flaw exploited in the wild this year. Previous bugs were linked to the APT28 group or incomplete patches. It remains unclear if this latest issue connects to those same threats.

Another bug involves Microsoft Office SharePoint and is tracked as CVE-2026-102866. Attackers can modify proof tokens to authenticate as targeted users without authorization. Dustin Childs, head of threat awareness at the Zero Day Initiative, flagged this for quick attention.

The company marked the flaw as less likely to be exploited due to specific conditions needed. Childs also noted Microsoft has plugged 55 wormable flaws across critical infrastructure like DHCP Server. These bugs let attackers run code remotely without user interaction.

Security researchers say AI is helping find bugs faster but not creating them. Childs advises teams to focus on patches proven to be exploited rather than counting CVEs. The volume of updates is less important than the risk level of each bug.