Key points
- CVE-2026-96951 allows remote attackers to bypass the Mark of the Web security feature.
- Microsoft confirmed the flaw was exploited in the wild before the October 2026 patch.
- The vulnerability carries a CVSS score of 8.8, classified as high severity.
Microsoft patched a command injection vulnerability in Windows Shell during its October 2026 Patch Tuesday update. The flaw, tracked as CVE-2026-96951, allows unauthorised attackers to bypass security controls over a network. Microsoft confirmed that this zero-day was actively exploited in the wild prior to the release of the fix.
According to Tenable, this update addressed 1,407 CVEs across 301 products. CVE-2026-96951 received a CVSSv3 score of 8.8 and was rated as important. It is the third Windows Shell flaw exploited in the wild in 2026, following patches issued in February and April of the same year.
Context and background
The vulnerability stems from improper neutralisation of special elements in commands within Windows Shell. This weakness enables an attacker to bypass the Mark of the Web (MOTW) security feature. MOTW is designed to warn users when they open files downloaded from the internet, helping to prevent the execution of malicious content.
Who is affected
Any system running affected versions of Windows Shell is at risk. Attackers can exploit this flaw using social engineering tactics. They may send emails or messages convincing targets to open malicious files. Successful exploitation bypasses the intended security warnings associated with downloaded content.
What happens next
Security teams should apply the October 2026 update immediately to remediate CVE-2026-96951. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on 13 October 2026. Federal agencies had until 16 October 2026 to apply mitigations in accordance with BOD 26-04 guidance.
Why this attack works
Attackers often rely on users to execute initial payloads, using social engineering to trigger the flaw. This technique exploits the gap between user intent and system enforcement. When a shell fails to sanitise input, it may execute commands hidden within seemingly benign files. Teams usually monitor for unusual command-line activity originating from user directories. Check whether your environment logs shell execution paths effectively. Ensure that endpoint detection tools alert on unexpected process spawning from downloaded files. This approach helps identify attempts to bypass standard safety mechanisms.
What to do and how to stay safe: Microsoft
- Deploy the October 2026 Microsoft security updates to all affected Windows systems.
- Review email logs for suspicious attachments or links that may have triggered the exploit.
- Monitor Windows Shell execution logs for anomalous command injection patterns.
- Educate users on recognising social engineering attempts involving file downloads.
Step-by-step guide: Patch Management Policy: How to Automate Fixes Without Breaking Systems
General security guidance from the Payload Report newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-96951?
It is a command injection vulnerability in Windows Shell that allows attackers to bypass the Mark of the Web security feature.
Was this vulnerability exploited in the wild?
Yes, Microsoft confirmed that CVE-2026-96951 was exploited in the wild as a zero-day before the patch was released.
How severe is this vulnerability?
The National Vulnerability Database rates CVE-2026-96951 as high severity with a CVSSv3 score of 8.8.
