{"id":"windows-shell-motw-bypass-cve-2026-96951-oct","category":"patch","status":"closed","title":"Microsoft patches exploited Windows Shell Mark of the Web bypass (CVE-2026-96951)","tldr":"Microsoft fixed CVE-2026-96951 on 13 Oct 2026, a Windows Shell flaw already used in attacks to bypass Mark of the Web warnings on downloaded files. CISA lists it as exploited. Install the October Windows updates now and be wary of unexpected files.","summary":"Microsoft's October 2026 Patch Tuesday included a fix for CVE-2026-96951, a command injection flaw in Windows Shell rated CVSS 8.8. It lets an attacker get around Mark of the Web, the Windows label that marks files from the internet or email as untrusted. If someone opens a specially crafted file, Windows skips the usual warning, Protected View and blocking. Files can arrive by email, chat or collaboration tools, or by download from a malicious website, and the person has to open the file. Microsoft lists the flaw as exploited, and CISA added it to its Known Exploited Vulnerabilities catalogue on 13 October 2026. Fixes cover supported Windows 10 and Windows 11 versions, with Microsoft also listing Edge and Outlook.com entries. No attacker has been named; Tenable noted that it is unclear whether the activity is linked to APT28 or to an incomplete earlier fix. I could not load Microsoft's own advisory page, so version details come from the feed supplied. No later developments were found.","action":"Run Windows Update and install the October 2026 updates on every Windows 10 and 11 computer, and update Microsoft Edge. Until then, do not open unexpected files from email, chat or websites, even if no warning appears.","product":"Microsoft Windows 10 and Windows 11 (Windows Shell)","audience":"both","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-96951"],"tags":["microsoft","windows","zero-day","mark-of-the-web","patch-tuesday","cisa-kev","windows-shell"],"affected":["Windows 10 Version 1607 below 10.0.14393.9612","Windows 10 Version 1809 below 10.0.17763.9376","Windows 10 Version 21H2 below 10.0.19044.7807","Windows 10 Version 22H2 below 10.0.19045.7807","Windows 11 version 23H2 below 10.0.22631.7652","Microsoft Edge (Chromium-based) below 154.0.4258.62","Outlook.com below 20260925.100"],"fixed":["Windows 10 1607: 10.0.14393.9612","Windows 10 1809: 10.0.17763.9376","Windows 10 21H2: 10.0.19044.7807","Windows 10 22H2: 10.0.19045.7807","Windows 11 23H2: 10.0.22631.7652","Microsoft Edge: 154.0.4258.62","Outlook.com: 20260925.100"],"matches":[{"platform":"windows","app":"Windows 10 Version 22H2","bundle":"","fixed":"10.0.19045.7807"},{"platform":"windows","app":"Windows 10 Version 21H2","bundle":"","fixed":"10.0.19044.7807"},{"platform":"windows","app":"Windows 10 Version 1809","bundle":"","fixed":"10.0.17763.9376"},{"platform":"windows","app":"Windows 10 Version 1607","bundle":"","fixed":"10.0.14393.9612"},{"platform":"windows","app":"Windows 11 Version 23H2","bundle":"","fixed":"10.0.22631.7652"},{"platform":"edge","app":"Microsoft Edge","bundle":"","fixed":"154.0.4258.62"}],"sources":[{"kind":"advisory","title":"CVE-2026-96951 Security Update Guide","url":"https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-96951","by":"Microsoft MSRC","date":"2026-10-13"},{"kind":"advisory","title":"CISA Known Exploited Vulnerabilities bulletin","url":"https://content.govdelivery.com/accounts/USDHSCISA/bulletins/42f0923","by":"CISA","date":"2026-10-13"},{"kind":"news","title":"Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days","url":"https://www.bleepingcomputer.com/news/microsoft/microsoft-october-2026-patch-tuesday-fixes-1-411-flaws-3-zero-days/","by":"BleepingComputer","date":"2026-10-13"},{"kind":"news","title":"Microsoft fixes exploited Mark of the Web bypass vulnerability (CVE-2026-96951)","url":"https://www.helpnetsecurity.com/?p=387855","by":"Help Net Security","date":"2026-10-14"}],"started":"2026-10-13","closed":"2026-10-14","created":"2026-11-03T21:24:41.810Z","updated":"2026-11-03T21:24:41.810Z","cve_notes":[{"cve":"CVE-2026-96951","name":"Mark of the Web bypass via Windows Shell command injection","what":"A command injection flaw in Windows Shell that lets an attacker's crafted file skip Mark of the Web protections, so Windows shows no warning when a downloaded file is opened.","severity":"high","cvss":8.8}],"timeline":[{"at":"2026-10-14","added":"2026-11-03T21:23:52.346Z","kind":"other","text":"Help Net Security reported that the flaw can be triggered by a crafted file sent by email, chat or download, with no warning shown. Tenable said it is unclear whether the attacks are linked to APT28; no actor is named.","url":"https://www.helpnetsecurity.com/?p=387855","by":"Help Net Security","patch":null},{"at":"2026-10-13","added":"2026-11-03T21:23:52.346Z","kind":"cisa-added","text":"CISA added CVE-2026-96951 to its Known Exploited Vulnerabilities catalogue, citing evidence of active exploitation.","url":"https://content.govdelivery.com/accounts/USDHSCISA/bulletins/42f0923","by":"CISA","patch":null},{"at":"2026-10-13","added":"2026-11-03T21:23:52.346Z","kind":"disclosed","text":"Microsoft released its October 2026 Patch Tuesday updates, including a fix for CVE-2026-96951, a Windows Shell flaw that bypasses Mark of the Web protections and is listed as exploited in attacks.","url":"https://www.bleepingcomputer.com/news/microsoft/microsoft-october-2026-patch-tuesday-fixes-1-411-flaws-3-zero-days/","by":"BleepingComputer","patch":"patched"}],"url":"https://hard.fyi/live/windows-shell-motw-bypass-cve-2026-96951-oct/","json":"https://hard.fyi/api/live?id=windows-shell-motw-bypass-cve-2026-96951-oct"}