[Urgent] Windows CVE-2026-96951: Exploited Bypass of Mark of the Web Protection (CVSS v3.1 8.8) — Apply the October Update; Do Not Open Files You Receive Casually

On 13 October 2026, Microsoft fixed a Windows Shell vulnerability, CVE-2026-96951, in its monthly update. It can let an attacker evade Mark of the Web (MOTW), the marker Windows puts on files that came from the internet. Microsoft says exploitation was detected when the update was published, and CISA added it the same day to its KEV catalog (vulnerabilities known to be exploited) with a due date of 16 October. It affects a wide range of Windows 10, Windows 11 and Windows Server releases.

First, what is known and what is not. Known: (1) Microsoft lists "Exploited: Yes", (2) Microsoft lists "Publicly Disclosed: No", and (3) fixed builds exist. Not known: who is using it, how widely, and against whom. The official material does not say, and KEV's "known ransomware campaign use" field is "Unknown".
With exploitation confirmed, there is no reason to wait. Apply the update first.

What to do now

• ✓Run Windows Update and restart. In Settings, open Windows Update and install the October updates. The fix only takes effect after the restart. Check especially if you have turned automatic updates off or have not restarted for a long time.
• ✓Confirm your Windows is patched in the update history. In Settings, Windows Update, then Update history, look for the KB number in the list below. For example, Windows 11 24H2, 25H2 and 26H2 get KB5127648, and Windows 10 21H2 and 22H2 get KB5126657.
• ✓If you still use Windows 10, first check whether you can receive the update. Standard editions of Windows 10 (Home, Pro and so on) reached end of support on 14 October 2025 (IPA; LTSC editions have a separate lifecycle). The KB5126657 page lists its "Applies To" as Windows 10 ESU, Windows 10 Enterprise LTSC 2021 and Windows 10 IoT Enterprise LTSC 2021. It does not say that a standard edition without ESU can receive it. If you cannot, move to a supported successor such as Windows 11, or to an alternative product (IPA's guidance).
• ✓Confirm with the sender by another route before opening files that arrive by email or chat. The flaw lets an attacker evade the defenses that rely on Mark of the Web (MOTW), the marker on files from the internet. Warnings and protections that depend on MOTW may not work, so do not treat the absence of the usual warning as evidence a file is safe (our own inference; Microsoft does not describe the exact behavior after the bypass). In Microsoft's description the attacker sends a crafted file and the user has to act, by clicking a link or opening an attachment. (Our own note: do not open or save files from people you do not know.)
• ✓Administrators: check how far the update has been deployed. CISA's due date is 16 October. For machines you cannot update, switch to a rule of not opening externally received files on them. (Our own note, not an official procedure.)

What happens (Microsoft's description)

• ▸Where and what: a command injection in Windows Shell (improper handling of special characters; CWE-77). Microsoft names it "Windows Shell Security Feature Bypass".
• ▸What is bypassed: Microsoft says a successful attacker "could evade Mark of the Web (MOTW) defenses". MOTW is the marker on files that came from the internet, which Windows uses to show warnings or open files in a protected state.
• ▸How an attack works: the scenario is an email or chat message that delivers a crafted file. The attacker cannot force the user to view it; the user has to take an action such as clicking a link or opening an attachment (this matches "user interaction required" in the CVSS vector).
• ▸What follows: the official description stops at "security feature bypass" and does not say what runs afterwards. The CVSS impact is high for confidentiality, integrity and availability, and CISA's rating says technical impact is total, but that describes how the score is built; the contents of real attacks are not published.

Fixed builds (from MSRC: update and build for each OS)

• ▸Windows 11 24H2, 25H2 and 26H2: KB5127648. Fixed builds: 24H2 10.0.26100.9711, 25H2 10.0.26200.9711, 26H2 10.0.26300.9711.
• ▸Windows 11 26H1: KB5127646 (10.0.28000.3231). Windows 11 23H2: KB5126653 (10.0.22631.7652).
• ▸Windows 10 22H2: KB5126657 (10.0.19045.7807). Windows 10 21H2: KB5126657 (10.0.19044.7807). The KB5126657 page lists both builds (the MSRC table also shows 19044.7807 for 22H2). Windows 10 1809: KB5126651 (10.0.17763.9376). Windows 10 1607: KB5126868 (10.0.14393.9612).
• ▸Windows Server 2025: KB5126646 (10.0.26100.33650). 2022: KB5126655 (10.0.20348.5761). 2019: KB5126651 (10.0.17763.9376). 2016: KB5126868 (10.0.14393.9612). 2012 R2: KB5126836 (6.3.9600.23470).
• ▸Outlook.com (web mail) is also listed as an affected product. Its MSRC entry is a "Release Notes" item, and I did not confirm whether any user action is needed.
• ▸I found no workaround or mitigation in the MSRC entry. Within the vendor information I could confirm, applying the fix is the priority.

What happened, with dates

• ▸13 October 2026: Microsoft published its October monthly security updates and listed CVE-2026-96951 as exploited. The same day, CISA added it to KEV (due 16 October) and it was registered in NVD.
• ▸14 October (the day of this check): NVD shows "Undergoing Analysis". The CVSS v3.1 8.8 (HIGH) was assigned by Microsoft, not by NIST. CISA's SSVC rating in NVD is exploitation: active, automatable: no, technical impact: total.
• ▸Another KEV addition the same day: CISA also added Ivanti Connect Secure (CVE-2026-104935) to KEV on 13 October (CISA describes it as leading to command execution without authentication). This article does not cover it. If your organization uses it, check CISA's KEV entry and Ivanti's advisory.

What I could not confirm

• ▸What the attacks look like. The official material does not say who is exploiting it, at what scale, or with what kind of file. KEV lists ransomware use as "Unknown".
• ▸What runs after the bypass. The official description ends at evading MOTW defenses.
• ▸Whether a standard Windows 10 edition (Home, Pro and so on) without ESU can receive the update. I confirmed that the KB lists ESU and LTSC under "Applies To", but not what any particular machine can receive.
• ▸NIST's rating. It showed "Undergoing Analysis" on 14 October. The 8.8 (HIGH) is Microsoft's value and may change once NIST adds its own.
• ▸Indicators of compromise (IoCs). The official sources give no file names or log patterns for detection.

The three lines to share

• ▸A Windows flaw (CVE-2026-96951, CVSS v3.1 8.8) lets attackers evade Mark of the Web (the marker on files from the internet) defenses, and Microsoft confirms it is exploited. It was fixed in the 13 October update.
• ▸★Run Windows Update and restart. Windows 11 24H2, 25H2 and 26H2 need KB5127648; Windows 10 21H2 and 22H2 need KB5126657. Standard editions of Windows 10 are out of support, so check whether you can get the update.
• ▸Until you have updated, confirm with the sender by another route before opening files that arrive by email or chat. The absence of the usual warning is not proof a file is safe.