Windows Shell Mark of the Web bypass: CVE-2026-96951

Mark of the Web is the tag Windows attaches to files that arrive from the internet. SmartScreen, Office Protected View and similar checks rely on it to decide when to warn or restrict. CVE-2026-96951 is a flaw in Windows Shell that lets a crafted file get past those checks, and attackers were already using it before the fix shipped.

Microsoft fixed it on 13 October 2026 and marked it as exploited. CISA added it to its Known Exploited Vulnerabilities catalog the same day and gave federal agencies until 16 October to patch. Microsoft has said very little about how the bypass works, so the update itself is the main defense.

Who is affected

Microsoft lists Windows client and server releases back to Server 2012 R2, including Server Core installations and both x64 and ARM64 builds:

Microsoft's table also lists Outlook.com and, since a revision on 26 October, Microsoft Edge 154.0.4258.62. Exposure depends on people, not open ports: the attacker needs a user to open a file they sent.

How the Mark of the Web bypass works

When a browser or mail client saves a downloaded file, Windows records where it came from in a hidden Zone.Identifier stream. Windows and Office read that tag before opening the file and show warnings or open it in a restricted mode. If the tag is missing or ignored, the file is treated like a local one.

Microsoft describes CVE-2026-96951 as command injection (CWE-77) in Windows Shell that lets an unauthenticated attacker evade Mark of the Web over a network. Its scenario is a crafted file sent by email or instant message. The attacker cannot force the file open; they have to persuade someone to click a link or open an attachment.

Microsoft scored it 8.8 under CVSS 3.1: network attack, no privileges, user interaction required, and high impact on confidentiality, integrity and availability. It has not published the vulnerable component, the file types involved or an exploit chain. Some blogs describe a route through ZIP, ISO or disk-image containers. Microsoft has not confirmed that, and neither has any named responder, so treat it as unverified.

Microsoft credits four reporters: yhw; Benoit Sevens, using Claude with Anthropic; and Riku Bamba and Yuya Chudo of Fujitsu.

Is it being exploited?

Yes. Microsoft lists it as exploited and not publicly disclosed before the patch. CISA added it to the KEV catalog on 13 October with a due date of 16 October and flagged it for forensic triage. CISA's own assessment records active exploitation and total technical impact, but rates it not automatable.

What is not known matters as much. No threat actor, malware family, campaign or first-exploitation date has been published. That leaves no confirmed window to hunt back through.

The release around it was very large. Counts differ by source: Microsoft's update data, as revised through 27 October, shows 1,407 Microsoft-assigned CVEs published on 13 October. Tenable counts 1,407, BleepingComputer 1,411 (excluding 348 bugs fixed earlier in the month) and SecurityWeek 1,413. Tenable counts 69 critical, BleepingComputer 70. Two more bugs were publicly disclosed before the fix but not exploited: CVE-2026-108398 in .NET Framework and CVE-2026-92707 in MessagePack-CSharp.

Check your exposure

Compare each machine's build with the fixed build for its release in the table above:

# Full build number, for example 26100.9711
$v = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
"$($v.CurrentBuild).$($v.UBR)"
 
# Is the October cumulative update for this release installed?
Get-HotFix -Id KB5127648 -ErrorAction SilentlyContinue

Swap in the KB for each release. At fleet scale, your patch management or endpoint inventory can report the same build number.

Fix it

Install the October 2026 cumulative update for each Windows release and restart, then confirm the build number has changed. Update Microsoft Edge to 154.0.4258.62 or later. Microsoft lists no workaround or mitigation, so nothing short of the update closes the bypass.

Until every machine is patched, the usual email controls lower the odds of a user opening the file: block or quarantine risky attachment types at the mail gateway, and remind users that a missing warning does not mean a file is safe.

Detect attempts and compromise

Microsoft has published no indicators, detection rules or log events for this CVE. Generic Mark of the Web hunting still helps, with clear limits:

• Missing tags. Files saved by browsers or mail clients that have no Zone.Identifier stream deserve a look. A missing stream has other causes and does not prove exploitation.
• Stream creation. Sysmon Event ID 15 records alternate data stream creation, including Zone.Identifier, which gives you a baseline to compare against.
• What ran next. Office applications or Explorer starting script hosts or unfamiliar executables shortly after a user opened an attachment.

If any of these line up on a machine that was unpatched, treat it as compromised and investigate what the opened file ran, not just whether a warning appeared.

Beyond this patch

Mark of the Web is a warning layer, not a security boundary, and Tenable counts this as the third Windows Shell flaw exploited in the wild in 2026. Keep mail and download filtering in front of it, keep users' rights low, and confirm patches by build number rather than by a deployment report.