Windows zero-day: the download warning is gone (13/10/2026)
A Windows Shell flaw already used in attacks strips the « this file came from the internet » warning. A second exploited flaw hits Ivanti remote access. Both fixes are dated 13 October 2026.
The short version
On 13 October 2026 Microsoft patched a Windows Shell flaw already being exploited in attacks: CVE-2026-96951, which the vendor scores 8.8 out of 10[1][2]. It lets an attacker remove the « this file came from the internet » warning, the Mark of the Web prompt your staff see when they open a downloaded attachment[1]. The same day, the US agency CISA added this Windows zero-day, and an Ivanti Connect Secure authentication bypass, to its catalogue of actively exploited flaws[2][5].
What the flaw actually does
When a file arrives from the internet, Windows tags it with a provenance marker, the Mark of the Web, and warns the user on opening. CVE-2026-96951 is a command injection in Windows Shell that lets an unauthenticated attacker bypass that protection over the network[1][2]. The scenario Microsoft describes is entirely ordinary: the attacker sends a specially crafted file by email or instant message, and the user has to open it or click a link. Microsoft notes there is no way to force a victim to view attacker-controlled content, so someone still has to be persuaded[1].
Two details matter. First, Microsoft rates the flaw Important rather than Critical, yet reports exploitation as detected, and it had not been publicly disclosed before the patch[1]. A flaw already in use that nobody saw coming should not be triaged by its severity label. Second, the vector the vendor records requires user interaction but ends in high impact on confidentiality, integrity and availability[1][2]. One click, and the machine belongs to the attacker.
CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 13 October as « Microsoft Windows Command Injection Vulnerability », with remediation required by 16 October 2026[2][3]. Read that date correctly: it binds US federal agencies, not an SME in Belgium, France, the Netherlands or Luxembourg. It is still the clearest public signal of urgency available, and three days says a great deal.
The other patch of the day: Ivanti Connect Secure
On the same 13 October a second exploited flaw was listed, with the same deadline: CVE-2026-104935, an authentication bypass by spoofing in Ivanti Connect Secure[4][5]. It affects versions before 25.1.3.0 and lets a remote, unauthenticated attacker execute arbitrary commands; the vendor states that version 22.7R2.14 and earlier are not affected[4][5]. The score is 8.6 out of 10 and no user action is needed[5].
If your remote access runs through an Ivanti appliance, that is today's priority, ahead of the Windows estate: a no-interaction flaw on an internet-facing box is found in minutes with a scanner, and there is nobody to fool. It is the pattern we described two weeks ago with the two NetScaler flaws exploited before the patch shipped, and then the FortiMail flaw on the mail gateway. Three times in one month, the way in was not a laptop but the device guarding the door.
| Flaw | Product | Score | User interaction |
|---|---|---|---|
| CVE-2026-96951 | Windows Shell, Mark of the Web bypass | 8.8[1] | Yes: open a file[1] |
| CVE-2026-104935 | Ivanti Connect Secure before 25.1.3.0 | 8.6[5] | No[5] |
Why a Windows zero-day changes the maths for an SME
Most security awareness training rests on one instruction: if Windows warns you the file came from the internet, think before you open it. CVE-2026-96951 removes that warning[1]. The employee doing exactly what they were taught now sees nothing unusual. That is the difference between human error, which training fixes, and an invisible trap, which it does not.
The practical consequence is to stop relying on user judgement for this class of file and check the barriers that remain: macros blocked in documents originating from the internet, attachment filtering at the gateway, endpoint detection, and above all the real gap between a Microsoft patch being published and it being installed across the estate. That gap is the only measure that counts, and it is also the one most SMEs never take. In our reading of the ANSSI report on the DGFiP intrusion, the chain was the same: nothing exotic, just missing controls and no detection.
Four countries: who you call when it happens
The flaws are identical everywhere; the contact is not. In Belgium, the CCB and its CERT.be issue national advisories and receive reports. In the Netherlands it is NCSC-NL, with the RDI for duties arising from the Cyberbeveiligingswet. In France, ANSSI and its CERT-FR. In Luxembourg, CIRCL, with the ILR for regulated sectors.
If your company falls under NIS2, a significant incident is not only a technical matter: it must be reported, within deadlines and in a form set by each national transposition. Our country pages set out who is in scope: NIS2 in Belgium, in the Netherlands, in Luxembourg, and for France our analysis of the transport and logistics perimeter. Settle that question before an incident, not during one.
To do this week
- Check whether an Ivanti Connect Secure appliance is in service and note its version: anything before 25.1.3.0 and after 22.7R2.14 goes first[4].
- Confirm the Microsoft updates of 13 October 2026 are installed on every Windows desktop and server, not just the ones that reboot often[6].
- Pull the list of machines still unpatched after seven days: that is your patch indicator, worth reviewing monthly.
- Verify by policy that macros are blocked in documents originating from the internet, since the provenance marker can be bypassed[1].
- Tell your teams in one sentence: a file can now open with no warning at all, so caution no longer depends on the yellow banner.
- Write down who to call by country, CCB/CERT.be, NCSC-NL, CERT-FR or CIRCL, plus your IT provider's number kept offline.
At CyberNovaLabs.io
We help SMEs in the Netherlands, Belgium, France and Luxembourg hold two things together: an estate patched in days rather than months, and attachments filtered before they reach an inbox. Our email security check and our cybersecurity page show what we look at first. If you want a straight answer on your real patch gap, let us talk for twenty minutes.
Sources
- Microsoft Security Update Guide - CVE-2026-96951, Windows Shell Security Feature Bypass Vulnerability (13/10/2026)
- NIST NVD - CVE-2026-96951, detail et statut CISA KEV (13/10/2026)
- CISA - Known Exploited Vulnerabilities Catalog, ajouts du 13/10/2026
- Ivanti - Security Advisory Ivanti Connect Secure CVE-2026-104935 (13/10/2026)
- NIST NVD - CVE-2026-104935, Ivanti Connect Secure (13/10/2026)
- Microsoft - October 2026 Security Updates, note de publication (13/10/2026)
Qualified meetings, no lock-in.
Criteria in writing before launch, pay per meeting or monthly, stop with a simple email.
Read next
Critical PHP flaws: your website is affected (21/10/2026)
Two critical vulnerabilities in PHP, the engine under most small-business websites, allow unauthenticated remote code execution. Patches shipped on 21 October 2026. What to check this week, and what will never be fixed.
Read the article →October 22, 2026 · 9 min readNIS2 Netherlands: are software vendors and IT providers in scope?
Publishing software is not a listed category in Dutch law. Running a client's infrastructure, hosting it, monitoring it, is. Here is how to settle your own case in ten minutes, with the Dutch dates, the right regulator and the main-establishment rule that decides who inspects you.
Read the article →October 15, 2026 · 8 min readNIS2 Luxembourg: are accounting firms and fiduciaries in scope?
The Law of 5 May 2026 never once mentions accountancy. That does not make your firm safe: three entry points remain, and only one really concerns Luxembourg fiduciaries.
Read the article →October 14, 2026 · 7 min readNIS2 Belgium: manufacturing, who is actually in scope?
Most Belgian factories are outside the scope of NIS2, and those inside find out through a NACE code, not through their revenue. The six Annex II categories, the Belgian deadlines that have already lapsed, the fine ceilings, and the Flemish grant few manufacturers claim.
Read the article →October 13, 2026 · 7 min readFridges hijacked: the CERT-FR Danfoss alert (12/10/2026)
A cyberattack drove freezers in hundreds of French supermarkets to 50 degrees. The box at fault was not an IT server: it was a refrigeration controller fitted by a cooling engineer, reachable from the internet, never updated. Thousands of SMEs have one.
Read the article →October 13, 2026 · 8 min readOutsourcing B2B appointment setting: 10 clauses to check
An appointment setting contract is decided on ten clauses, not on a day rate. France has banned consumer cold calling without prior consent since 11 August 2026 and Bloctel no longer exists; the EU AI Act transparency duties have applied since 2 August 2026. Here are the ten clauses, and the calling regime of all four countries.
Read the article →