Three Windows flaws are being used in attacks. Here’s the update that fixes them.

The one that arrives by email

CVE-2026-96951, fixed October 13. Windows marks files that came from the internet, including email attachments and downloads, so it can warn you before they open. This flaw lets a crafted file or link skip that warning. Microsoft says the attacker has to persuade someone to open the file or click the link, which is exactly what a convincing invoice or delivery email is for. Microsoft scores it 8.8 and has seen it used in attacks; CISA added it to its exploited list the same day.

The two that need a foothold first

CVE-2026-85880 and CVE-2026-81963, fixed September 8. Both let someone who is already running code on a PC, through malware or an ordinary user account, take full control of it. The first affects Windows 10 and Windows Server 2012 through 2022; the second affects Windows 11 and Windows Server 2025. Microsoft scores both 7.8 and has seen both used in attacks.

Flaws like these are what turn one opened attachment into full control of a machine, which is why all three are worth installing together.

Check a PC in a minute

1. Install updatesSettings, then Windows Update, then Check for updates. Install everything and restart. An update waiting on a restart isn’t installed yet.
2. Confirm the buildPress Windows + R, type winver and press Enter. The build number should match the list below or be higher.
3. Or look for the KB numberSettings, Windows Update, Update history lists installed updates by KB number.

October builds that include all three fixes

• Windows 11 24H2, 25H2 and 26H2: KB5127648, builds 26100.9711, 26200.9711 and 26300.9711.
• Windows 11 26H1: KB5127646, build 28000.3231. Windows 11 23H2: KB5126653, build 22631.7652.
• Windows 10 21H2 and 22H2: KB5126657, builds 19044.7807 and 19045.7807.
• Windows Server 2025: KB5126646, build 26100.33650. Server 2022: KB5126655, build 20348.5761. Server 2019: KB5126651, build 17763.9376. Server 2016: KB5126868, build 14393.9612. Server 2012 R2: KB5126836, build 9600.23470.
• Windows Server 2012 (not R2) is only listed for CVE-2026-85880: September’s KB5123065, build 9200.26349, or later.

A note on Windows 10

Microsoft still publishes these updates for Windows 10, but most Windows 10 PCs only receive them if they’re enrolled in Extended Security Updates. If a Windows 10 PC shows nothing new under Windows Update this month, that’s the likely reason, and it’s missing all three fixes. Enroll it, upgrade it to Windows 11, or replace it.

Sources

• Microsoft: CVE-2026-96951, Windows Shell security feature bypass
• Microsoft: CVE-2026-85880, Windows ALPC elevation of privilege
• Microsoft: CVE-2026-81963, Windows Update Stack elevation of privilege
• CISA Known Exploited Vulnerabilities catalog
• Our vulnerability database: CVE-2026-96951