1 (888) 897-3611 Book a call

Threat advisory · Multiple

Microsoft's October update fixes an exploited Windows flaw, and is the last for Windows 11 24H2 Home and Pro

Microsoft's Oct. 13, 2026 update fixes an exploited Windows Shell flaw and is the last for Windows 11 24H2 Home and Pro. Install it, then move to 25H2.

By happier IT 5 min read

Microsoft’s October 13, 2026 security update fixes a Windows Shell flaw, CVE-2026-96951, that attackers have already exploited, and it is the final update for Windows 11 version 24H2 Home and Pro. Install the October update on every Windows PC now, then move any 24H2 Home or Pro machines to version 25H2.

What happened

On October 13, 2026, Microsoft released its monthly security updates, often called Patch Tuesday. BleepingComputer reported that the release fixes 1,411 vulnerabilities, a record for a single month, including 70 rated critical.

Three of the flaws are what Microsoft calls zero-days: problems that were exploited or made public before a fix existed.

  • CVE-2026-96951, Windows Shell (actively exploited). Microsoft describes it as a command injection flaw that lets an attacker bypass a Windows security feature over a network. BleepingComputer reported that the feature affected is the Mark of the Web (MotW). That is the hidden label Windows attaches to files downloaded from the internet. According to MITRE ATT&CK, the label is what makes Office files open in Protected View and lets Microsoft Defender SmartScreen warn before an unknown program runs. Getting around it means a harmful file can open without those warnings.
  • CVE-2026-108398, .NET Framework (publicly disclosed). Microsoft says it lets an attacker bypass Windows Defender Application Control (WDAC), a feature that limits which programs can run.
  • CVE-2026-92707, MessagePack-CSharp (publicly disclosed). A denial-of-service flaw that BleepingComputer lists as moderate severity.

The same day, Microsoft said that “the October 2026 monthly security update is the last update available” for Windows 11 version 24H2 Home and Pro, and for Windows 10 Enterprise LTSB (Long-Term Servicing Branch) 2016.

What is not yet known: BleepingComputer reported that Microsoft has not shared how CVE-2026-96951 was exploited or who reported it. There is no public information about attacks on Canadian organizations.

Who is affected

  • Anyone running Windows who has not installed the October 13 update is exposed to the exploited Windows Shell flaw.
  • PCs on Windows 11 24H2 Home or Pro. After October 13, these machines no longer get security fixes. TechRepublic reported that Home and Pro editions of 24H2 are not eligible for Extended Security Updates (ESU), so moving to a newer version is the only way to keep them patched.
  • Windows 11 24H2 Enterprise and Education are not affected by the end-of-support change. They stay supported until October 12, 2027.

What to do now

If you use a Windows PC at home or at work:

  1. Open Settings, then Windows Update, and select Check for updates. Install everything offered and restart.
  2. To check your version, press the Windows key and R, type winver, and press Enter. If it says Version 24H2 and you are on Home or Pro, install the Windows 11 25H2 feature update from the same Windows Update screen. Pureinfotech reported that the move does not require a full reinstall.
  3. Be cautious with unexpected downloads and email attachments this month. Until every PC is patched, Windows may not show its usual warning before opening one.

If you run an organization:

  1. Confirm the October 2026 update has reached every Windows device, including laptops that are rarely on the office network.
  2. Pull a report of Windows versions and editions from your device management tool. TechRepublic advises checking both the build number and the licence edition, since 24H2 Pro and 24H2 Enterprise end support a year apart.
  3. Schedule 25H2 upgrades for any 24H2 Home or Pro machines.
  4. Look at Microsoft’s other October fixes, and at the October updates from other vendors BleepingComputer listed, including Citrix, Fortinet and Ivanti, several of which include exploited flaws.

What this means for organizations in BC and Alberta

A PC that stops getting security updates is harder to defend, and if someone gets in through it, that can become a privacy question as well as a technical one.

  • Federally (PIPEDA): organizations covered by the Personal Information Protection and Electronic Documents Act must report a breach of security safeguards to the Office of the Privacy Commissioner of Canada, and notify affected people, when it creates a real risk of significant harm. They must keep a record of every breach of security safeguards for two years.
  • Alberta (PIPA): section 34.1 of the Personal Information Protection Act requires an organization to notify Alberta’s Information and Privacy Commissioner without unreasonable delay when a reasonable person would consider there is a real risk of significant harm.
  • British Columbia: BC’s private-sector Personal Information Protection Act does not currently require breach reporting, but the Office of the Information and Privacy Commissioner for BC strongly recommends it. Public bodies under the Freedom of Information and Protection of Privacy Act (FIPPA) must report breaches likely to cause significant harm.

For organizations across British Columbia and Alberta, keeping a simple list of which devices run which Windows version makes both the patching and any later privacy assessment much easier.

How happier IT helps

Getting monthly updates onto every device, and spotting the machines that have fallen off support, is what our patch management service does. It’s part of everyday managed IT services, including planning version upgrades so they don’t interrupt your day. If you’d like to know where your devices stand, start with a free IT assessment.

Sources

Common questions

Is the October 2026 Windows zero-day being exploited?
Yes. Microsoft says CVE-2026-96951, a flaw in Windows Shell that lets attackers get around the Mark of the Web safety label on downloaded files, has been exploited. Microsoft has not said how it was used or by whom. Installing the October 13, 2026 update fixes it.
Does Windows 11 24H2 still get security updates?
Not on Home and Pro. Microsoft said the October 2026 security update is the last one for Windows 11 version 24H2 Home and Pro. Enterprise and Education editions of 24H2 stay supported until October 12, 2027.
How do I move off Windows 11 24H2?
Microsoft recommends moving to Windows 11 version 25H2. On most PCs you open Settings, then Windows Update, select Check for updates, and install the feature update if it is offered. It does not need a full reinstall.

More from the feed

Other incidents we've written up.

Want to know what this would look like for you?

A 30-minute call. No slides, no audit fee, no obligation. We ask what is breaking and tell you honestly whether we are the right fit.

Book a 30-minute call Get a free IT assessment

Or call 1 (888) 897-3611