Microsoft fixes an already exploited Windows flaw and ends patches for Windows 11 24H2 Home and Pro

What happened

On 13 October 2026, Microsoft released its monthly security update. Among the flaws fixed is CVE-2026-96951, a vulnerability in Windows Shell, the component that handles the desktop and opening files. Microsoft marks it as exploited: attackers were already using it before the patch existed.

According to Microsoft's advisory, an attacker who exploits the flaw "could evade Mark of the Web (MOTW) defenses". That is the tag Windows puts on files that come from the internet, which triggers security warnings before they are opened. The scenario it describes: the attacker sends a specially crafted file by email or messaging, and the victim has to open it or click a link.

That same day, the US cybersecurity agency (CISA) added the flaw to its catalogue of actively exploited vulnerabilities.

What we know

• Severity: Microsoft gives it a CVSS score of 8.8 out of 10 and rates it "Important". It requires no credentials, but the user does have to open the file.
• Affected systems (according to Microsoft): Windows 10, Windows 11 (versions 23H2, 24H2, 25H2, 26H1 and 26H2) and Windows Server 2016, 2019, 2022 and 2025. On Windows 10 22H2 and Windows Server 2012 R2, the fix only reaches computers enrolled in the Extended Security Updates (ESU) programme.
• Fix: the cumulative update of 13 October 2026. On Windows 11 24H2, 25H2 and 26H2 it is KB5127648.
• End of support: in that same update, Microsoft states that "Windows 11, version 24H2 Home and Pro has reached end of updates" and that the October 2026 update is the last one for those editions. Version 25H2 will receive patches until 12 October 2027, and 26H2 until 10 October 2028.
• Windows 10 22H2 reached end of support on 14 October 2025. Since then, only computers with ESU, a paid programme, receive patches.

What we don't know yet

• Who is exploiting the flaw, against whom and since when. Microsoft has not published this. According to BleepingComputer, it has not said who discovered it either.
• Whether there are victims in Spain. None have been confirmed.

Why it matters

The warnings Windows shows when you open a downloaded file are one of the last barriers against phishing with attachments. A flaw that removes them makes a malicious file look as harmless as an internal one.

The second notice is easier to miss, but its effects may last longer. Windows 11 24H2 has been available since October 2024, so it may be on a large share of the office's computers. If they are not updated to a newer version, from November they will get no fixes for new flaws as they appear.

What it means for an SME

In a 20-person company, email is the most common way in: invoices, quotes, delivery notices. With this flaw, an attachment that looks routine opens without any warning.

Also, Pro is the edition business computers usually run, and in many SMEs nobody knows for sure which version each one has. A laptop that has been "working fine" for months may be about to stop receiving patches.

What your company should do this week

1. Check that every computer has installed the 13 October update, including laptops and servers.
2. Take an inventory of versions. Ask your IT provider for a list of computers on Windows 11 24H2 Home or Pro and plan their move to 25H2 or 26H2 before the November update.
3. Find any remaining Windows 10 machines. If they are not enrolled in ESU, they no longer receive patches: enrol them or replace them.
4. Remind your team not to open unexpected attachments, even if Windows shows no warning. If an email with an invoice or document wasn't expected, confirm it by phone before opening it. More tips in our phishing guide (in Spanish).
5. Put in writing who is responsible for updates and how you check they have been installed. That is exactly what a maintenance plan covers.