NewsCompaniesFlawsGuides
Get the app
HighFixedBeing used in attacksClosedUpdated

Microsoft patches exploited Windows Shell Mark of the Web bypass (CVE-2026-96951)

Microsoft fixed CVE-2026-96951 on 13 Oct 2026, a Windows Shell flaw already used in attacks to bypass Mark of the Web warnings on downloaded files. CISA lists it as exploited. Install the October Windows updates now and be wary of unexpected files.

What to do

Run Windows Update and install the October 2026 updates on every Windows 10 and 11 computer, and update Microsoft Edge. Until then, do not open unexpected files from email, chat or websites, even if no warning appears.

Check your devices
  • Windows 10 Version 22H2fixed in 10.0.19045.7807 and later
  • Windows 10 Version 21H2fixed in 10.0.19044.7807 and later
  • Windows 10 Version 1809fixed in 10.0.17763.9376 and later
  • Windows 10 Version 1607fixed in 10.0.14393.9612 and later
  • Windows 11 Version 23H2fixed in 10.0.22631.7652 and later
  • Microsoft Edgefixed in 154.0.4258.62 and later

What’s happening

Microsoft's October 2026 Patch Tuesday included a fix for CVE-2026-96951, a command injection flaw in Windows Shell rated CVSS 8.8. It lets an attacker get around Mark of the Web, the Windows label that marks files from the internet or email as untrusted. If someone opens a specially crafted file, Windows skips the usual warning, Protected View and blocking. Files can arrive by email, chat or collaboration tools, or by download from a malicious website, and the person has to open the file. Microsoft lists the flaw as exploited, and CISA added it to its Known Exploited Vulnerabilities catalogue on 13 October 2026. Fixes cover supported Windows 10 and Windows 11 versions, with Microsoft also listing Edge and Outlook.com entries. No attacker has been named; Tenable noted that it is unclear whether the activity is linked to APT28 or to an incomplete earlier fix. I could not load Microsoft's own advisory page, so version details come from the feed supplied. No later developments were found.

What
Flaw
Affects
Microsoft Windows 10 and Windows 11 (Windows Shell)
Affected
Windows 10 Version 1607 below 10.0.14393.9612
Windows 10 Version 1809 below 10.0.17763.9376
Windows 10 Version 21H2 below 10.0.19044.7807
Windows 10 Version 22H2 below 10.0.19045.7807
Windows 11 version 23H2 below 10.0.22631.7652
Microsoft Edge (Chromium-based) below 154.0.4258.62
Outlook.com below 20260925.100
Fixed in
Windows 10 1607: 10.0.14393.9612
Windows 10 1809: 10.0.17763.9376
Windows 10 21H2: 10.0.19044.7807
Windows 10 22H2: 10.0.19045.7807
Windows 11 23H2: 10.0.22631.7652
Microsoft Edge: 154.0.4258.62
Outlook.com: 20260925.100
CVE
CVE-2026-96951
Since
13 Oct 2026
Closed
14 Oct 2026

Timeline

  1. Update

    Help Net Security reported that the flaw can be triggered by a crafted file sent by email, chat or download, with no warning shown. Tenable said it is unclear whether the attacks are linked to APT28; no actor is named.

  2. CISA added

    CISA added CVE-2026-96951 to its Known Exploited Vulnerabilities catalogue, citing evidence of active exploitation.

  3. Made publicFixed

    Microsoft released its October 2026 Patch Tuesday updates, including a fix for CVE-2026-96951, a Windows Shell flaw that bypasses Mark of the Web protections and is listed as exploited in attacks.

Sources

  1. CVE-2026-96951 Security Update GuideMicrosoft MSRC · 13 Oct 2026
  2. CISA Known Exploited Vulnerabilities bulletinCISA · 13 Oct 2026
  3. Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-daysBleepingComputer · 13 Oct 2026
  4. Microsoft fixes exploited Mark of the Web bypass vulnerability (CVE-2026-96951)Help Net Security · 14 Oct 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from October 2026 · JSON · RSS