Urgent · Update Windows and Microsoft Edge to address an exploited Windows Shell flaw.

Microsoft confirms that CVE-2026-96951 is being exploited and lists security updates for affected Windows versions and Microsoft Edge. Install the available Windows security updates and update Edge to version 154.0.4258.62 or later.

This clarifies the earlier Windows Shell alert: Microsoft added Edge to its affected-products guidance on October 26. It is not a newly added CISA catalog entry. CISA lists ransomware use as unknown.

Sources: Microsoft advisory, Microsoft affected products and fixes, CISA catalog.