Windows Shell CVE-2026-96951 Zero-Day Skips Mark of the Web

Windows Shell CVE-2026-96951 is a security feature bypass that attackers are already using to strip Mark of the Web warnings from downloaded files. Microsoft fixed it in the October 13, 2026 Patch Tuesday release and lists it as exploited. CISA added it to the Known Exploited Vulnerabilities catalog the same day with a federal due date of October 16. It affects every supported Windows client and server build. Deploy the October cumulative update to the users who receive the most outside email and downloads first.

What happened

Microsoft's October release is the largest Patch Tuesday on record. BleepingComputer counts 1,411 flaws, 70 of them rated Critical, while SOCRadar counts 1,413. Three were zero-days, and only one of them, CVE-2026-96951, is marked as exploited in the wild.

Microsoft's CVE record describes the bug as improper neutralization of special elements in a command (CWE-77, command injection) in Windows Shell. Its summary says it "allows an unauthorized attacker to bypass a security feature over a network." The CVSS 3.1 score is 8.8 with the vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C. Microsoft rates it Important, not Critical, and has not said who reported it or how it was used.

The security feature in question is Mark of the Web, the tag Windows writes on files that arrive from the internet. When that tag is missing, Windows and Office treat a downloaded file as local. SOCRadar notes that SmartScreen and Protected View warnings then do not appear. The user still has to open the file, which is why the vector shows UI:R.

This is the third exploited Windows Shell flaw of 2026. Expert Insights lists CVE-2026-21510 in February and CVE-2026-32202 in April before it.

Who is affected

The CVE record lists these fixed builds. Anything below them is vulnerable:

Windows 11 26H2: 10.0.26300.9711
Windows 11 25H2: 10.0.26200.9711
Windows 11 24H2 and Windows Server 2025: 10.0.26100.9711 for Windows 11; 10.0.26100.33650 for Server 2025
Windows 11 26H1: 10.0.28000.3231
Windows 11 23H2: 10.0.22631.7652
Windows Server 2022: 10.0.20348.5761
Windows 10 1809 and Windows Server 2019: 10.0.17763.9376
Windows 10 1607 and Windows Server 2016: 10.0.14393.9612
Windows 10 21H2 and 22H2: the record gives 10.0.19044.7807 for both
Windows Server 2012 R2: 6.3.9600.23470

The Windows 10 22H2 line looks like a data-entry slip, since 22H2 uses the 19045 build branch. Check the KB article for the exact 22H2 build before you write a compliance query against it. Server Core installations share the same fixed builds as their full editions. The record also lists Outlook.com, a Microsoft-hosted service, with a fixed service build of 20260925.100.

BleepingComputer lists the Windows 11 cumulative updates as KB5127648 and KB5126653, and the Windows 10 extended security update as KB5126657.

How the Windows Shell bypass works

Mark of the Web is not a malware scanner. It is a label. Windows adds a small Zone.Identifier stream to files saved from the Internet or Restricted sites zones, and Microsoft's documentation lists zone 3 as Internet. Office reads that label to decide whether to block macros, and Windows reads it to decide whether to show SmartScreen and open-file warnings. Our explainer on what Mark of the Web is and how Windows uses it walks through the zones and the places the tag gets lost.

A bypass in Windows Shell matters because the shell is the code that opens files when a user double-clicks them. If an attacker can deliver a file that the shell handles without honoring the tag, every downstream control that relies on it stays silent. The attack still starts with social engineering: an email attachment, a chat message or a download link. Microsoft has not published the file type or the exact path, and you should not expect it to.

The E:F field in the vector means Microsoft rates exploit code as functional. Combined with a confirmed in-the-wild listing and a three-day KEV deadline, the Important severity label understates the risk. We explain why that happens with this class of bug in why security feature bypass bugs deserve emergency patching.

The other two zero-days were publicly disclosed but not exploited. CVE-2026-108398 is a .NET Framework security feature bypass that can get past Windows Defender Application Control, credited to James Forshaw of Google Project Zero. CVE-2026-92707 is a denial-of-service flaw in the MessagePack-CSharp library.

What to do now

Patch high-exposure users first. Start with mailboxes and roles that receive the most external attachments: finance, HR, sales, executive assistants, help desk. Then move to the general fleet and servers. A ring structure keeps this from becoming a single risky push; see how to use patch deployment rings for a Windows zero-day.
Keep the downstream controls enforced by policy. SOCRadar recommends keeping SmartScreen and Protected View enforced by policy until patch coverage is complete. Microsoft also recommends enabling the "Block macros from running in Office files from the Internet" policy as part of its Microsoft 365 Apps security baseline.
Verify with two signals. Confirm installs from your endpoint management console and from an independent vulnerability scan or build-number query. A device that reports "update pending" is still exposed.
Tighten attachment filtering for the window. Review which file types your mail gateway allows through from external senders. Archive and container formats are the usual carriers for files meant to be opened outside normal warnings.
Plan for end-of-support devices. BleepingComputer notes that October is the final update for Windows 11 24H2 Home and Pro and for Windows 10 Enterprise LTSB 2016. Those machines get this fix and nothing after it.

How to detect exploitation attempts

Microsoft has not published indicators. Without them, focus on behavior around file opens:

Endpoint alerts for scripting engines, installers or LOLBins launched by Explorer shortly after a user opens an attachment or download.
Mail gateway logs for external messages carrying archives or shortcut-style files to the high-exposure groups above in the last two weeks.
Users reporting that a downloaded file opened "without the usual warning." Treat that report as a lead, not a nuisance ticket.

What to watch next

Watch for Microsoft to update the advisory with exploitation details, or for a researcher write-up that names the file type. Either would let you write targeted detections. Watch the next Patch Tuesday for a fourth Windows Shell bypass, which would point to a design weakness rather than a single bug. If you track how this month compares with September's release, our coverage of Microsoft's 974-CVE September Patch Tuesday has the baseline.