Cyber threats
WA Cyber Security Unit flags an actively exploited Windows vulnerability fixed by Microsoft
A WA Government advisory says Microsoft has released updates for CVE-2026-96951, a Windows flaw that Microsoft says has been exploited.
The Western Australian Government’s Cyber Security Unit has published an advisory about a Windows vulnerability, CVE-2026-96951, that it describes as actively exploited. The advisory says Microsoft has published updates to fix it.
According to the advisory, Microsoft is aware that one or more of the listed issues have been exploited, and the United States cybersecurity agency CISA has added them to its Known Exploited Vulnerabilities catalogue. The advisory says successful exploitation “could allow an unauthorized attacker to bypass a security feature over a network”. It rates the issue 8.8 (High) on the CVSS severity scale.
Who it affects
Windows computers. The advisory doesn’t list the affected versions itself; it points to Microsoft’s Security Update Guide entry for CVE-2026-96951 for the products and versions Microsoft lists.
The advisory is written for WA Government agencies. It says the unit had no reports of exploitation on WA Government networks at the time of writing.
What the advisory says to do
The WA Cyber Security Unit recommends applying the vendor’s fixes to all affected devices, in line with its patch management guidance.
Our Windows computer security basics guide explains how Windows Update works, step by step, based on Microsoft’s instructions. Businesses can read about patching in our Essential Eight explainer.