A Mark of the Web bypass in Windows Shell, tracked as CVE-2026-96951, is being used in real attacks, and Microsoft patched it in its October 2026 security updates. If your PC still hasn’t installed that month’s updates, a booby-trapped file could skip the warnings Windows normally shows before you open it. The fix is to run Windows Update, and to stay suspicious of unexpected files until it’s done.
Here’s the short version:
- CVE-2026-96951: a Windows Shell security feature bypass, tied to command injection (CWE-77).
- Microsoft fixed it in the October 2026 Patch Tuesday release, disclosed October 13.
- Attackers are already exploiting it, according to Help Net Security and the Center for Internet Security.
- It needs you to open a file, so email, chat apps and downloads are the likely delivery routes.
- Microsoft rates it Important, with a CVSS v3.1 score of 8.8.
That list is the whole story in miniature: a patch exists, the bug is live in the wild, and you are the final step in the attack.
What the Mark of the Web actually does for you
When you download a file or receive one from the internet, Windows tags it with a small piece of metadata called the Mark of the Web. On NTFS drives it lives in a hidden Zone.Identifier data stream attached to the file.
That tag is what triggers the safety nets you’ve probably clicked through: SmartScreen reputation checks, Protected View in Office, and the “this file came from another computer” prompt. Take the tag away, or trick Windows into ignoring it, and those checks never run.
How this Mark of the Web bypass works, as far as anyone knows
Not much technical detail is public. Microsoft describes an unauthorized attacker bypassing a Windows Shell security feature over a network, and, per GBHackers, the exact file structure and command syntax haven’t been disclosed.
What is clear, according to Help Net Security, is that opening a specially crafted file skips the protections that would normally warn you, open the file read-only in Protected View, or block it. A user has to take the action, so the usual lures apply: an email attachment, a message in Teams or Slack, or a download from a malicious site.
Here’s how a normal file compares with one that exploits the flaw:
| What happens | Normal downloaded file | File using the bypass |
|---|---|---|
| Windows recognizes the file as from the internet | Yes | No, the check is skipped |
| SmartScreen or Protected View steps in | Usually | Can be prevented from activating |
| You see a warning before opening | Yes | Possibly none |
| What you have to do | Open the file | Open the file |
The last row is the important one. Nothing about the attack removes the need for you to click.
Why a Windows Shell exploit deserves attention
Tenable’s Satnam Narang told Help Net Security this is the third Windows Shell flaw exploited this year. It’s also still unclear whether the new bug patches an incomplete earlier fix or is connected to the APT28 group, so treat any attribution you read elsewhere with caution.
The October update was enormous, with Help Net Security counting over 1,400 security bugs. That volume is exactly how a single exploited flaw gets lost in the noise. Trend Micro’s Dustin Childs’ advice is to patch what’s proven, prioritized and public, rather than ranking updates by CVE count, and this one fits all three.
How to protect your PC today
Start with the update itself. Open Settings, go to Windows Update, and select Check for updates. Neither source names a KB number or lists affected Windows versions, so don’t hunt for one; install everything offered, and confirm the October 2026 cumulative update is in your update history.
While you’re checking, these habits cut the risk further:
- Don’t open attachments or downloads you weren’t expecting, even from people you know.
- Treat files shared through chat or collaboration apps with the same suspicion as email.
- Keep SmartScreen and your antivirus switched on.
- If you manage other people’s PCs, push the October updates first and test later.
Layered habits matter here because a bypass removes one layer, not all of them. If you also want to confirm your machine’s deeper protections are healthy, our guide to checking your Secure Boot certificate is a good companion check.
How to spot a file that has lost its warning label
You can’t reliably tell a bypassed file by looking at it, which is the whole problem. You can, however, check what Windows thinks about any file you did download on purpose.
Right-click the file, choose Properties, and look near the bottom of the General tab for an “Unblock” checkbox. If it’s there, Windows has marked the file as coming from elsewhere. If a file you know came from the internet has no such note, that’s worth a second look before you open it.
Social engineering is a common partner to bugs like this one. If a page ever asks you to paste a command to “verify” yourself, read why fake verification pages are a trap first.
Frequently Asked Questions
What is CVE-2026-96951?
It’s a Windows Shell vulnerability that lets a crafted file skip Mark of the Web protections. Microsoft rates it Important with a CVSS score of 8.8, and attackers are exploiting it.
Do I need to install a special patch?
No special tool is mentioned. The fix shipped in Microsoft’s October 2026 security updates, so installing them through Windows Update covers it.
Can this attack infect me without my doing anything?
No. Sources say user interaction is required, meaning you have to open the malicious file. That’s why caution with unexpected attachments still helps.
Which versions of Windows are affected?
The reports we found don’t list specific versions. Check Microsoft’s advisory for the CVE, and apply the October updates on any supported Windows system to be safe.
My take: this isn’t a “panic” story, but it’s a “stop postponing updates” one. A bypass that needs a click is easy to ignore, and that’s precisely why attackers like it. Install the October update today, and make a habit of pausing before opening anything that arrives unasked.
Leave a Reply