Windows flaw used in attacks is fixed; 24H2 Home and Pro get their last update

Microsoft’s October 13, 2026 security updates fix a Windows flaw that attackers were already using, tracked as CVE-2026-96951. It lets a malicious file slip past the warning Windows normally shows before you open something downloaded from the internet.^{1, 2} The same month also brought the last security update for Windows 11 version 24H2 Home and Pro.⁴

Reporting checked October 24, 2026.

Too long; didn’t read?

• CVE-2026-96951 is a Windows Shell flaw that bypasses the “Mark of the Web” protection. It was exploited before the fix was available.^{1, 2}
• The US cybersecurity agency CISA added it to its list of actively exploited vulnerabilities on October 13.³
• Install the October 13 update: KB5127648 for Windows 11 24H2, 25H2 and 26H2, KB5126653 for 23H2, KB5126657 for Windows 10 with Extended Security Updates.^{4, 5, 6}
• On Windows 11 24H2 Home or Pro? This was your last security update. Upgrade to the latest Windows 11 version.⁴

What the flaw does

When you download a file or receive one from the internet, Windows tags it as coming from outside your computer. That tag is called the Mark of the Web, and it is what makes Windows show a warning, or open some files in a restricted mode, before they can do harm.

According to CERT Vanuatu’s advisory, CVE-2026-96951 lets a malicious file avoid those Mark of the Web protections, so Windows skips its usual warnings. The attacker still needs you to open the file, which is why such files usually arrive with a convincing email or message.²

In other words, the warning that might have made you stop and think does not appear. The file can be just as dangerous as before; it only looks more harmless.

What is known about the attacks

BleepingComputer reported that Microsoft fixed a record 1,411 flaws this month and marked CVE-2026-96951 as an actively exploited zero-day, meaning it was used in attacks before a fix existed. Microsoft has not shared how attackers used it or who reported it.¹

CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 13 and gave US federal agencies until October 16 to patch it.³

Two other flaws were publicly disclosed before the fix but were not reported as exploited: CVE-2026-108398 in the .NET Framework, which could get around Windows Defender Application Control restrictions, and CVE-2026-92707, a denial-of-service bug in the MessagePack-CSharp library.¹

Which update you need

• Windows 11 24H2, 25H2 and 26H2: KB5127648, released October 13 (OS builds 26100.9711, 26200.9711 and 26300.9711).⁴
• Windows 11 23H2: KB5126653, released October 13 (OS build 22631.7652).⁵
• Windows 10 21H2 and 22H2: KB5126657, released October 13 (OS builds 19044.7807 and 19045.7807). Home and Pro PCs only get it if they are enrolled in Extended Security Updates.^{6, 9}

Windows 11 24H2 Home and Pro: this was the last one

Microsoft’s update notes say that Windows 11 version 24H2 Home and Pro “has reached end of updates” and that the October 2026 security update is the last one for these editions. Devices that stay on 24H2 will no longer receive protection against new threats. Microsoft recommends upgrading to the latest version of Windows 11.⁴

This matters more than it sounds: the next time a flaw like CVE-2026-96951 turns up, a PC still on 24H2 Home or Pro will not get the fix.

What you can do

• Check your version. Open Settings > System > About and look under “Windows specifications” for the edition (Home, Pro) and the version (for example 24H2).⁷
• Run Windows Update. In Windows 11, open Settings > Windows Update and select “Check for updates”. In Windows 10, it is under Settings > Update & Security > Windows Update. Restart when asked: the fix is not active until you do.⁸
• On 24H2 Home or Pro, install the newer Windows 11 version offered in Windows Update, so you keep receiving security fixes.⁴
• Still on Windows 10 without Extended Security Updates? Your PC no longer gets fixes like this one. Microsoft’s advice is to upgrade to Windows 11 if the PC qualifies, or to enroll in Extended Security Updates or replace the device.⁹
• Be careful with attachments and downloads you did not expect, especially this month. A missing warning is not proof that a file is safe.

Sources

1. BleepingComputer, October 13, 2026: Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days
2. CERT Vanuatu, October 13, 2026: Advisory 355: Microsoft Windows Shell Mark of the Web security feature bypass
3. CISA: Known Exploited Vulnerabilities Catalog (CVE-2026-96951 added October 13, 2026)
4. Microsoft Support, October 13, 2026: KB5127648 (OS Builds 26300.9711, 26200.9711 and 26100.9711)
5. Microsoft Support, October 13, 2026: KB5126653 (OS Build 22631.7652)
6. Microsoft Support, October 13, 2026: KB5126657 (OS Builds 19045.7807 and 19044.7807)
7. Microsoft Support: Find information about your Windows device
8. Microsoft Support: Install Windows Updates
9. Microsoft Support: Windows 10 support has ended on October 14, 2025