Windows Shell Flaw CVE-2026-96951 Lets Crafted Files Dodge Mark of the Web, and Microsoft Says It Is Exploited

CVE-2026-96951 is a Windows Shell security feature bypass that Microsoft flagged as exploited when it published its October 2026 updates on 13 October. A specially crafted file sent by email or instant message can evade Mark of the Web (MOTW) defenses. CISA added the bug to its Known Exploited Vulnerabilities (KEV) catalog the same day with a due date of 16 October, and fixes shipped in the October cumulative updates. Windows 10 PCs outside the Extended Security Updates (ESU) program do not get this one.

What happened

Microsoft's advisory for CVE-2026-96951, titled "Windows Shell Security Feature Bypass Vulnerability", rates it Important and marks it Exploitation Detected. It is not publicly disclosed. The CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:N/UI:R), with a temporal score of 8.2. Both scores come from Microsoft; NVD lists the entry as "Undergoing Analysis" and has not added its own.

CISA added the CVE to KEV on 13 October 2026 and set a remediation due date of 16 October, three days later. The required action is to apply vendor mitigations under CISA's BOD 26-04 and follow its Forensics Triage Requirements. CISA lists known ransomware campaign use as "Unknown". CISA's KEV entry names the bug "Microsoft Windows Command Injection Vulnerability", and Microsoft's CWE for it is CWE-77, command injection. It is the same CVE under two names.

Microsoft and CISA acted on 13 October; the KEV due date is 16 October.

Why it matters

Mark of the Web is the zone marker Windows attaches to files that arrive from the internet or from outside the local network. Other Windows and Office protections key off it. Microsoft's FAQ says an attacker who exploits this bug "could evade Mark of the Web (MOTW) defenses".

Microsoft's advisory does not say which downstream protections are skipped. It names neither SmartScreen nor Office Protected View. Our inference: a file that loses its MOTW treatment would not trigger the checks and restrictions that depend on that marker, which is why defenders usually treat MOTW bypasses as a way to remove a warning step from an attack chain. That is a reading of how MOTW works, not something Microsoft states about this CVE.

The bug does not give code execution on its own, as far as the advisory describes. Microsoft's FAQ describes only the defense bypass. The attacker still needs a payload that benefits from running without MOTW-based friction, and a user to open the file or follow a link. That is why the CVSS vector has UI:R. Microsoft says the attacker cannot force a user to view the content.

Exposure is broad. Microsoft lists fixes for Windows 10, Windows 11 and Windows Server 2012 R2 through Server 2025, so any unpatched machine where users open files from email or chat is in scope. The Windows 10 fix, KB5126657, applies to Windows 10 ESU, Windows 10 Enterprise LTSC 2021 and Windows 10 IoT Enterprise LTSC 2021. A Windows 10 22H2 PC that is not enrolled in ESU is not offered it, and cannot be patched this way (for a different, local Windows bug fixed in an earlier cycle, see the Cross Device SYSTEM escalation).

Not the first time

This is the latest of a long run of exploited MOTW and SmartScreen bypasses. CISA's KEV feed lists Microsoft entries going back to CVE-2022-41091 (added 8 November 2022), including CVE-2023-36025 (14 November 2023, SmartScreen), CVE-2024-21351 (13 February 2024, SmartScreen) and CVE-2024-38217 (10 September 2024, MOTW protection mechanism failure). It is not only a Microsoft problem: 7-Zip's CVE-2025-0411, a MOTW bypass, was added on 6 February 2025. The pattern is that attackers keep returning to this protection because losing a warning step is cheap for them. That last point is our reading, not a CISA finding.

Technical details

What is confirmed:

• Class: command injection (CWE-77) in Windows Shell, leading to a security feature bypass over the network.
• Attack scenario (Microsoft FAQ): an attacker sends a targeted user a crafted file by email or instant message and convinces them to open it or click a link.
• Privileges and complexity: no privileges required, low attack complexity.
• CISA SSVC data (carried in NVD): exploitation "active", automatable "no", technical impact "total".

The October 2026 cumulative updates carry the fix. These are the KB articles and fixed builds listed in Microsoft's update guide:

October 2026 fixes for CVE-2026-96951, per Microsoft's update guide.

Microsoft's list has 31 affected-product entries; the table groups the ones that share a KB. Microsoft's data also lists Outlook.com, a cloud service, as fixed at service build 20260925.100, with the record flagging customer action as required and pointing to the release notes. Check the exact KB for your edition and architecture in the update guide before deploying.

One data slip to know about: Microsoft's data (and NVD, which repeats it) lists 19044.7807 for Windows 10 22H2. KB5126657's own page is titled "OS Builds 19045.7807 and 19044.7807", so 22H2 is fixed at 19045.7807 and 21H2 at 19044.7807. Use the KB figures.

What defenders should do

1. Patch before 16 October. Windows 10 machines not in ESU cannot take the fix, so enrol them or move them off the mail-and-chat path. US federal civilian agencies are bound by the KEV date, and other organizations should treat it as a reasonable priority signal. Deploy the October 2026 cumulative update for each affected build, starting with endpoints used for email and chat.
2. Verify, don't assume. Check that the installed build is at or above the fixed build in the table.
3. Follow CISA's forensics requirement if you are in scope. The KEV entry points to its Forensics Triage Requirements, which suggests agencies should look for signs of earlier exploitation, not just patch.
4. Hunt for pre-patch exposure. We have no indicators of compromise from any source. Reasonable, environment-dependent checks include files received by email or chat before you patched that executed without the usual MOTW-driven prompts, but there is no published detection for this CVE.
5. Mail and chat controls still apply. Attachment filtering and user warnings reduce the chance a crafted file is opened. Microsoft has not published a workaround, so none of these replaces the update.

What is still unclear

• Who is exploiting it, and against whom. No primary source names an actor, a campaign or a victim, and we do not attribute it.
• How the bypass works. Microsoft gives no technical detail, and we found no independent write-up.
• Which protections are skipped. Microsoft says "MOTW defenses" without naming SmartScreen, Protected View or other features.
• Workarounds. None are stated in the sources we read.
• Scale. Nothing indicates how many systems were targeted.

This article will be updated if Microsoft, CISA or researchers publish more.

Sources

• Microsoft Security Response Center, CVE-2026-96951 (update guide and API): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951
• NVD, CVE-2026-96951: https://nvd.nist.gov/vuln/detail/CVE-2026-96951
• CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96951