Mark-of-the-Web bypass via command injection in Windows Shell lets crafted files run without warnings (CVE-2026-96951)
Microsoft confirmed in-the-wild exploitation and CISA added the CVE to KEV on 2026-10-13 with a 2026-10-16 remediation deadline, so endpoints that do not take this month's cumulative update stay open to phishing-delivered files that execute without Mark-of-the-Web warnings.
A command-injection flaw in Windows Shell lets a specially crafted file delivered by email, instant message or a link evade Mark-of-the-Web defenses, so attacker-controlled content runs on the victim's machine without the usual security prompts once the user opens it. It is the one exploited zero-day in Microsoft's October 2026 Patch Tuesday.
Affected: Windows 10 Version 1607 builds below 10.0.14393.9612; Windows 10 Version 1809 builds below 10.0.17763.9376; Windows 10 Version 21H2 / 22H2 builds below 7807 (10.0.19044 / 10.0.19045 lines); Windows 11 Version 23H2 builds below 10.0.22631.7652; Windows 11 Version 24H2 builds below 10.0.26100.9711; Windows 11 Version 25H2 builds below 10.0.26200.9711; Windows 11 Version 26H1 builds below 10.0.28000.3231; Microsoft Outlook.com versions below 20260925.100
How to Test
Run winver or check the OS build via your endpoint management inventory and compare against the fixed builds listed above; any build below the threshold for its release line is vulnerable. For signs of attempted exploitation, review email and messaging gateway logs for attachments or links that delivered unusual file types to users, check endpoint telemetry for files that executed without a Mark-of-the-Web prompt after being downloaded from the internet, and deploy the Snort coverage Cisco Talos published for this Patch Tuesday.
How to Patch
Install the October 2026 Patch Tuesday cumulative update for each Windows release so the OS build reaches at least 10.0.14393.9612 (1607), 10.0.17763.9376 (1809), build 7807 for Windows 10 21H2/22H2, 10.0.22631.7652 (23H2), 10.0.26100.9711 (24H2), 10.0.26200.9711 (25H2) or 10.0.28000.3231 (26H1); Outlook.com is fixed in 20260925.100. Until patched, tighten mail and messaging controls on inbound file attachments and links.