
Windows Shell CVE-2026-96951 Hit CISA’s KEV: Install October’s Patch Before Phishing Files Skip Your Warnings
Microsoft’s October 2026 Patch Tuesday fixed CVE-2026-96951, an exploited Windows Shell flaw that lets booby-trapped files bypass Mark of the Web warnings like SmartScreen and Office Protected View. CISA added it to the KEV catalog Oct 13 with an Oct 16 due date. Here’s the NYC small-business checklist.












