Microsoft Patches Actively Exploited Windows Shell Flaw That Bypasses Mark of the Web
Summary
Microsoft patched actively exploited CVE-2026-96951, which lets attackers bypass Windows Mark of the Web protections after tricking a user into opening crafted content. Updates are available; CISA added the flaw to its KEV catalog.
Key points
- The Windows Shell flaw, CVE-2026-96951, is rated CVSS 8.8 and can bypass Mark of the Web protections.
- Exploitation requires user interaction, such as opening a crafted file delivered through email, messaging, or a deceptive download.
- Microsoft confirmed exploitation in the wild but has not disclosed responsible actors, targeted organizations, or the observed exploitation chain.
- Affected products include Windows 10, multiple Windows 11 releases, and Windows Server editions through Server 2025; Outlook.com was also listed as affected before a service-side fix.
- Microsoft issued patches in its October 13, 2026 security updates. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog, with an October 16 remediation deadline for applicable U.S. federal civilian agencies.
- The article recommends patching, monitoring file-delivery and subsequent process activity, and investigating suspicious downloads or attachments; it says no attack-specific public IOCs were disclosed.
Article Details
- Vulnerability Types
- Windows Shell security feature bypass
- Command injection (CWE-77)
- Severity
- High; CVSS 3.1 score 8.8
- Affected Versions
- Windows 10 (affected releases not specified)
- Windows 11 (affected releases not specified)
- Windows Server 2012 R2 through Windows Server 2025
- Outlook.com (before the service-side fix)
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Use application control, attack surface reduction policies, email attachment filtering, and endpoint protection as defense-in-depth measures.
- Restrict executable or script content from user-writable locations.
CVE
People
Benoit SevensCredited by Microsoft with reporting the vulnerability using Claude with Anthropic.Riku BambaCredited by Microsoft with reporting CVE-2026-96951.yhwCredited by Microsoft as a security researcher who reported the vulnerability.Yuya ChudoCredited by Microsoft with reporting CVE-2026-96951.
Vendors
Products
Microsoft WindowsMicrosoft has patched CVE-2026-96951, a high-severity Windows Shell security feature bypass vulnerability that is already being exploited in real-world attacks.Outlook.comMicrosoft’s record also lists Outlook.com as affected before the corresponding service-side fix.Windows ShellMicrosoft has patched CVE-2026-96951, a high-severity Windows Shell security feature bypass vulnerability that is already being exploited in real-world attacks.