Swiss SME Cyber Alert: Microsoft Windows – actively exploited protection bypass requires update verification
Microsoft confirms that CVE-2026-96951 in Windows Shell is being actively exploited. A crafted file can bypass a Windows security feature and then enable serious impact on the system; the user must open the file for the attack to work.
If your company uses Windows PCs or Windows Server, ask your IT provider today to confirm that the 13 October 2026 security updates are fully installed and any pending restarts have been completed.
What happened?
Microsoft released the fix on 13 October 2026. The vulnerability is in Windows Shell and results from improper handling of special command elements. Microsoft rates it CVSS 8.8; exploitation is confirmed, and CISA added CVE-2026-96951 to its KEV catalogue on the same day.
Could my company be affected?
This alert is relevant to organisations using Windows 10, Windows 11 or Windows Server. Microsoft lists Windows 10 1607, 1809, 21H2 and 22H2; Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2; and Windows Server 2012 R2, 2016, 2019, 2022 and 2025. Whether an individual device remains exposed depends on the October security update installed on it.
What should you do now?
Ask your IT provider to complete these checks now:
Confirm that the Microsoft security updates released on 13 October 2026 were installed successfully on every supported Windows PC and Windows Server.
Prioritise devices with failed or deferred updates and any machines still waiting for a restart.
Until coverage is confirmed, strengthen controls for unexpected attachments and downloads and investigate suspicious file-opening events.
How urgent is it?
High – verify today. The vulnerability is being actively exploited and affects widely used systems. It is not a zero-click attack, however: Microsoft states that user interaction is required. Where updates are centrally managed or deliberately delayed, it is not enough to assume that Windows will update automatically.
Information for your IT provider
CVE-2026-96951 is a Windows Shell vulnerability with a CVSS score of 8.8. The attack vector is network-based, requires no prior privileges, but does require user interaction. Microsoft describes the impact as a security-feature bypass caused by command injection. Use the MSRC table to identify the correct cumulative security update for each Windows release and verify successful installation.
