Laptop protected by a shield with update arrows

Windows Patch Alert: Update Now For CVE-2026-96951

aop3d tech
Safety Alert

Windows Patch Alert: Update Now For CVE-2026-96951

Microsoft's October update fixes a Windows flaw that attackers are already using. The fix takes about five minutes — here is exactly what to do, step by step.

What Happened

On October 13, 2026, Microsoft released its monthly Patch Tuesday security updates for Windows. One flaw in that release matters more than the rest: CVE-2026-96951, a problem in Windows Shell — the part of Windows that handles the files you open.

Microsoft has confirmed that attackers are already using this flaw. CISA, the U.S. government's cybersecurity agency, added it to its Known Exploited Vulnerabilities list the same day the fix came out, and told federal agencies to apply the fix by October 16.

What This Flaw Does, In Plain Words

When you download a file from the internet, Windows quietly tags it so your PC knows it came from outside. That tag is called Mark of the Web. It is the reason you sometimes see a safety warning before a downloaded file opens, and why Word opens documents from the internet in a safer read-only view first.

This flaw strips that protection away. A harmful file an attacker sends you can open as if it were a safe file you created yourself — no warning, no second look.

One thing working in your favor: the attacker cannot force this on you. They have to trick you into opening a rigged file or clicking a link, usually sent by email or instant message. And once you install the October update, the flaw is closed.

Fix It Now: The Exact Windows Update Steps

  1. Click Start and open Settings.
  2. Click Windows Update. (On Windows 11 it is in the left-hand menu. On Windows 10, go to Update & Security → Windows Update.)
  3. Click Check for updates.
  4. Let Windows download and install everything it finds.
  5. If Windows asks you to restart, restart — the fix is not finished until you do.

Keep your PC plugged in and connected to the internet while it updates. That is the whole fix — it comes straight from Microsoft.

⚠️ No Pop-Up Can Fix This

Scammers love news like this, so please read this part twice: no pop-up, website, download, or "fix-it" tool can patch this flaw — and any pop-up that claims it can is itself a scam trying to get onto your PC.

The only real fix is the Microsoft update in the steps above. Never pay for, download, or call a number from a pop-up about this. If a warning appears on your screen and you are not sure it is real, do not touch it — text 781-507-1606 and ask first.

Quick Summary

  • The flaw is CVE-2026-96951, in Windows Shell, and attackers are already using it.
  • It lets a bad downloaded file skip Windows' safety warnings — but only if you open it.
  • The fix: Settings → Windows Update → Check for updates → install → restart if asked.
  • No pop-up fixes this. Pop-ups claiming to fix it are scams.

Want a hand running the update, or did it fail partway through? Text the Wizard at 781-507-1606 — please text rather than call.

Already updated? Tell us in the comments how long it took — it helps your neighbors stop putting it off.

🧙 AOP3D Tech — Rockport's Tech Wizards · Text 781-507-1606 · aop3d.com

Back to blog