Windows Shell CVE-2026-96951: an exploited Mark-of-the-Web bypass, patch now

Microsoft's October 2026 Patch Tuesday shipped one fix that cannot wait for a maintenance window: CVE-2026-96951, a command-injection flaw in the Windows Shell that lets a crafted file slip past Mark of the Web — the tag Windows attaches to anything that arrived from the internet — and open as though the user had created it locally. Microsoft marks it "Exploitation Detected," CISA added it to the Known Exploited Vulnerabilities catalog the same day with a three-day federal deadline, and the attack needs nothing more exotic than a user double-clicking an email attachment. If your people open files they were sent, you are in scope.

Developing story — first published 21:24 CEST (19:24 UTC), October 13, 2026. Updated as the vendor and CISA publish more.

At a glance

CVE	CVE-2026-96951
Product / affected versions	Windows Shell · all supported Windows client and server — Windows 10 (1607 through 22H2), Windows 11 (22H2 through 25H2), Windows Server 2012 R2 through Server 2025
Fixed in	October 2026 cumulative updates, released 2026-10-13 — e.g. Windows 11 24H2/25H2 KB5127648 · Windows 11 22H2/23H2 KB5126653 · Windows Server 2025 KB5126646 · Windows Server 2022 KB5126655
CVSS	8.8 High · temporal 8.2 · CVSS 3.1, scored by Microsoft · AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Exploited in the wild	Yes — Microsoft: "Exploitation Detected"; CISA KEV
CISA KEV	Added 2026-10-13; federal due date 2026-10-16 (BOD 26-04, forensic triage required)
Public PoC	None public as of 2026-10-13 (Microsoft: "Publicly Disclosed: No")
Official advisory	MSRC CVE-2026-96951

What CVE-2026-96951 actually does

Mark of the Web (MOTW) is the quiet backbone of several Windows defenses. When a file is downloaded, extracted from an archive, or saved from an email client, Windows stamps it with a Zone.Identifier alternate data stream that records "this came from the internet." That stamp is what makes SmartScreen check the file's reputation, what forces Office to open the document in Protected View with macros disabled, and what makes the shell show the "are you sure you want to run this?" prompt. Strip the mark, and every one of those guardrails silently stands down.

CVE-2026-96951 is a command injection flaw — CWE-77, improper neutralization of special elements in a command — in the Windows Shell, the component that handles how files are opened, previewed, and launched. Microsoft classifies it as a security feature bypass and states plainly in its FAQ that a successful attacker "could evade Mark of the Web (MOTW) defenses." The delivery is ordinary social engineering: in Microsoft's own words, the attacker sends "a specially crafted file" over email or instant message and convinces the target to open it. There is no privilege requirement and no authentication (PR:N), the attack is over the network (AV:N), and it needs one click (UI:R).

That combination is why the confidentiality, integrity, and availability impacts are all rated High and the base score lands at 8.8. Microsoft rates the severity "Important" rather than "Critical" — the SFB class rarely earns Critical — but the label understates the operational reality. This is not a theoretical bypass: the exploitability flag is "Exploitation Detected," meaning Microsoft has seen it used against real targets before the patch existed. A severity word is a taxonomy; an active exploit is a measurement.

Who is exposed, and how to check your build

Every supported edition of Windows ships the affected shell component, from Windows Server 2012 R2 up to Server 2025 and from Windows 10 1607 to Windows 11 25H2. There is no "we don't run that product" exemption here — if it is Windows, it is affected until patched.

To check a host, compare its build number against the fixed build for its branch. winver shows it in a dialog; from a script, [System.Environment]::OSVersion.Version or cmd /c ver returns the full number. The relevant fixed builds:

Branch	Fixed build	KB
Windows 11 24H2 / 25H2	10.0.26100.9711 / 26200.9711	KB5127648
Windows 11 22H2 / 23H2	10.0.22631.7652	KB5126653
Windows Server 2025	10.0.26100.33650	KB5126646
Windows Server 2022	10.0.20348.5761	KB5126655
Windows 10 21H2 / 22H2	10.0.19044.7807	KB5126657
Windows Server 2019 / 10 1809	10.0.17763.9376	KB5126651
Windows Server 2016 / 10 1607	10.0.14393.9612	KB5126868
Windows Server 2012 R2	6.3.9600.23470	KB5126836

Any build below the figure for its branch is vulnerable.

Remediation

1. Am I affected?

Inventory every Windows host and compare its build against the table above. In PowerShell, Get-HotFix | Where-Object { $_.HotFixID -eq 'KB5127648' } (substitute the KB for the branch) confirms whether the October cumulative is installed. Anything short of the fixed build is in scope, including offline, imaged, and golden-master systems that have not booted since September.

2. Patch — exact fixed versions

Install the October 2026 cumulative update for each branch per the table. The fixes are available from Windows Update and the Microsoft Update Catalog. These are cumulative, so the current month's rollup carries the fix — there is no separate hotfix to chase.

3. Can't patch now? Compensating controls

Until the cumulative lands, raise the cost of the delivery chain:

• Enforce SmartScreen for both Explorer and Microsoft Edge via policy, so a reputation check still fires even when the file's zone data is in question.
• Keep Office Protected View on and block macros from the internet (the "Block macros from running in Office files from the Internet" policy). Most crafted-file chains still need the user to leave the sandbox.
• Turn on the relevant Attack Surface Reduction rules — in particular "Block executable content from email client and webmail" and "Block JavaScript or VBScript from launching downloaded executable content." These fire on the behavior regardless of the MOTW state.
• Strip or detonate risky attachments at the mail gateway — shortcuts (.lnk), script files, disk images (.iso, .vhd), and archives that re-wrap executables are the usual carriers for MOTW-bypass delivery.

4. Hunt for compromise

Microsoft and CISA have not published file hashes or indicators for this campaign yet, so hunt on behavior, not signatures. Map the chain to MITRE ATT&CK and look for:

• T1566 Phishing / T1204.002 User Execution: Malicious File — users opening attachments or downloaded files shortly before anomalous process activity.
• T1553.005 Subvert Trust Controls: Mark-of-the-Web Bypass — files executed from Downloads, %TEMP%, or archive-extraction paths that are missing the Zone.Identifier stream they should carry.
• T1059 Command and Scripting Interpreter — explorer.exe or a shell handler spawning cmd.exe, powershell.exe, wscript.exe, or mshta.exe as a child of a document or archive open.

5. Eradicate and verify

If you confirm execution, isolate the host, remove dropped artifacts and persistence, and rotate any credentials that were resident on the machine. Then patch, reboot, confirm the build has reached the fixed figure, and re-run the hunt to prove the behavior is gone — verification after the patch, not instead of it. CISA's entry carries a forensic-triage requirement, so preserve the evidence before you wipe.

What is not known yet

• The NVD record is not yet enriched — the NVD API returned no results for the ID as of 19:24 UTC on October 13, so there is no second independent CVSS score to compare against Microsoft's 8.8.
• No named threat actor, campaign, or victim sector has been attributed publicly. KEV lists ransomware use as "Unknown."
• No public proof-of-concept exists; Microsoft states the flaw was not publicly disclosed before the patch.
• Microsoft describes the delivery scenario (crafted file over email or IM) but has not published the specific file type or the in-the-wild exploit artifact.

We will update this post as the vendor and CISA release more.

Testing the bypass before an attacker does

"Exploitation Detected" means someone already proved this works on a real Windows build. The uncomfortable question for a defender is whether it works on yours — your golden image, your ASR baseline, your mail-gateway rules — and a version string in an inventory report cannot answer that. It tells you which build is installed, not whether a crafted file still sails through to execution on the way your estate is actually configured.

That is the gap an autonomous AI red team closes. Zero Hunt runs a 10-agent swarm that fingerprints the exact product and version, then has a sealed coding agent write a per-target proof-of-concept against that build — a generative exploit produced by local models, not a script pulled from a public repository, which matters precisely because no public PoC exists for this CVE yet. Every attempt runs in an ephemeral Docker container with gVisor hardening so it never touches the host, the campaign is black-box by default, and because the engine runs on-premise on its own private models, no file and no finding leaves the appliance. A human sits in the loop: at the autonomy levels most operators run, the crafted-file execution step waits for explicit approval before it fires, with recorded consent and a signed record written at the moment of the test.

Once the finding is proven, the pressure is a three-day KEV deadline across dozens of Windows builds, and there sequencing beats raw speed. Zero Hunt's AI Remediation Advisor ranks the fleet by real exploitability — KEV-listed first, then what the campaign actually proved reachable, then CVSS and EPSS — hands back the exact fixed build and KB per branch with rollout and rollback notes, names the ASR and SmartScreen control to hold the line while you stage, and re-verifies the fix with the same proof that demonstrated the issue. Every record is signed at write time and mapped across the frameworks that carry their own clocks — NIS2 and DORA in the EU, and the forensic-triage obligation CISA just attached — so the audit bundle is defensible, not a spreadsheet assembled after the fact.