A new high-severity weakness in the Windows operating system, tracked as CVE-2026-96951, has moved onto the U.S. government’s list of flaws that are already being exploited in real attacks. If a business still runs any unpatched version of Windows or Outlook.com, this one should be fixed this week.
Microsoft published the fix on October 13, 2026. The NIST National Vulnerability Database rates it 8.8 out of 10, a HIGH score, and the U.S. government has added it to its catalog of actively exploited flaws. Because attackers are already putting it to work, the gap between “known” and “patched” is where the risk lives.
What this weakness is, in plain language
The flaw sits in Windows Shell, the part of Windows that opens the files and web pages you click. The weakness is a form of command injection: a specially crafted file can trick Windows Shell into running a command it should not. What makes this one dangerous is that it gets around Mark of the Web, the safety signal Windows uses to mark files that arrived from the internet so they are treated with extra caution.
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. In plain terms: it can be reached over a network, needs low effort, requires no account, but does need a person to open the crafted file, and once it is opened it can take full control of confidentiality, integrity, and availability. That last part is why the score is HIGH rather than moderate.
Who is affected
According to the NIST record, the affected product list spans the Windows versions most businesses still run:
- Windows 10 (versions 1607, 1809, 21H2, 22H2)
- Windows 11 (versions 23H2, 24H2, 25H2, 26H1, 26H2)
- Windows Server 2012 R2, 2016, 2019, 2022, and 2025 (including Server Core)
- Outlook.com
In short, a typical Tampa office or a small business that has not applied the October 2026 Microsoft updates is likely within the affected range.
What to do now
Do not wait for the next patch cycle. Install the October 13, 2026 Microsoft security updates that include the fix for CVE-2026-96951, and make sure every Windows PC and server is current. If a machine cannot be patched quickly, limit where its users open files from and watch for unusual program activity until the update lands.
Virtual IT Group offers a security check for Tampa businesses that finds gaps like this before an attacker does. Patching this one is the first step; a review makes sure the rest of your setup is not quietly exposed.
AI-assisted