Microsoft patches CVE-2026-96951 in Windows Shell

Microsoft fixed CVE-2026-96951 in its October 2026 security update. The flaw affects Windows Shell, lets attackers bypass Mark of the Web (MOTW) protections, and was included among vulnerabilities being actively exploited as a zero-day. Tenable classified it as a security feature bypass with a CVSS score of 8.8.

What does CVE-2026-96951 do?

CVE-2026-96951 lets attackers bypass Mark of the Web defenses in Windows Shell, which affects the behavior of downstream controls that rely on that zone label. CrowdStrike said the bypass could neutralize protections such as SmartScreen, Office Protected View, and Application Guard, although that analysis is attributed to the firm and not to a separate official confirmation.

Microsoft treated the flaw as a zero-day that was being exploited in the wild. BleepingComputer included it among the issues addressed in the October 2026 Patch Tuesday and reported that it was being actively exploited. Tenable, meanwhile, said Microsoft fixed it as part of a batch of 1,407 CVEs.

How was it exploited, according to published analyses?

According to ITBrief Asia, successful exploitation may require the victim to open a specially crafted malicious file or visit an attacker-controlled website. CrowdStrike added that the attack requires explicit user action and does not happen through the preview pane.

CybersecurityNews said Microsoft classified CVE-2026-96951 as an important vulnerability with detected exploitation assessment, which would imply confirmed attacks rather than only a theoretical possibility. That attribution appears in secondary coverage and not in an official notice cited directly in the material available.

What other details did technical coverage provide?

WindowsForum.com published secondary coverage attributing to CISA the addition of CVE-2026-96951 to the KEV catalog and the release of fixed builds for several Windows branches. However, the available result does not link directly to CISA's official record or Microsoft's notice, so that point remains an unverified reference.

CyberDaily added that Windows Server 2012 did not receive a patch for this vulnerability, while Windows Server 2012 R2 does appear to be covered. The same coverage said Outlook.com had already been fixed in an earlier build.

The October 2026 update left CVE-2026-96951 among the month's most closely watched issues because of its zero-day status and the scope of the MOTW bypass. The combination of active exploitation, impact on Windows Shell, and a CVSS score of 8.8 drew attention from multiple security firms.

CVE-2026-96951

CVE-2026-96951 is the vulnerability Microsoft fixed in the October 2026 security update for Windows Shell. The flaw lets attackers bypass Mark of the Web and was included among vulnerabilities being actively exploited as a zero-day.

Tenable classified it as a security feature bypass with a CVSS score of 8.8. According to the coverage included in this note, the impact may extend to controls that depend on MOTW, such as SmartScreen, Office Protected View, and Application Guard.