Microsoft has patched an actively exploited Windows Shell zero-day vulnerability that allows attackers to bypass Mark of the Web protections. Tracked as CVE-2026-96951, the flaw was addressed in the October 2026 Patch Tuesday updates. It carries a CVSS score of 8.8 and is rated Important by Microsoft.
The vulnerability was not publicly disclosed before the update, but Microsoft confirmed that exploitation had already occurred. Its “Exploitation Detected” assessment signals a confirmed attack rather than a possible future threat. Microsoft’s Exploitability Index advises customers to give applicable updates in this category the highest priority.
Windows Shell 0-Day Exploited
The flaw involves command injection, where Windows Shell fails to properly handle special elements used in a command. Microsoft describes the outcome as a security feature bypass available to an unauthorized attacker over a network. Successful exploitation allows the attacker to evade Mark of the Web defenses.
Mark of the Web identifies files that come from the internet and helps Windows apply warnings or other protective checks. Bypassing this protection can remove an important barrier between a downloaded file and a user opening dangerous content. However, the reported impact is a security bypass, not a standalone remote code execution flaw.
Attackers can deliver a specially crafted file through email or instant messaging and use social engineering to persuade the target to open it. Exploitation requires user action. This means the flaw should not be treated as a zero-click attack, despite its network-based delivery path.
Earlier reporting on Windows LNK Stomping attacks described another way attackers bypassed Mark of the Web through Windows shortcuts. Separately, a WinZip Mark of the Web vulnerability showed how archive extraction could lose internet-origin tags. These are separate vulnerabilities, not confirmed techniques used in the current attacks.
The supplied Microsoft advisory credits Riku Bamba and Yuya Chudo of Fujitsu Limited, Benoit Sevens using Claude with Anthropic, and researcher yhw. It does not identify the attackers, their targets, the malicious file format, or the scale of exploitation. Those missing details limit conclusions about the campaign and its reach.
Security teams should prioritize applicable Windows updates and check Microsoft’s Security Update Guide for affected products. Testing and deploying the fix quickly is especially important because exploitation is confirmed. Users should remain cautious with unexpected attachments, since this attack depends on persuading someone to interact with attacker-controlled content.
An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.
