CVE-2026-96951: Windows Shell Mark of the Web Bypass Is Being Exploited—Install the October Update

On October 13, 2026, Microsoft closed a Windows Shell vulnerability in its monthly security updates that is already being used in attacks. The vulnerability is identified as CVE-2026-96951, and Microsoft rates it as “Important” with a CVSS score of 8.8. An attacker sends a crafted file by email or instant message; if the victim opens it, Mark of the Web (MotW) protection does not apply. Microsoft reports detected exploitation, and the U.S. agency CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog the same day. Updates are available for all listed Windows versions; Microsoft does not list a workaround.

Key facts at a glance

Affected versions and updates

The information comes from Microsoft’s Security Update Guide. In each case, every build below the listed build is affected.

For Windows 10 22H2, the Security Update Guide lists build 10.0.19044.7807. Microsoft’s KB page, however, lists KB5126657 with build 19045.7807 for 22H2 and 19044.7807 for 21H2; the table follows the KB page. Windows 10 22H2 and Windows Server 2012 R2 appear in the Security Update Guide only as ESU entries. Devices without Extended Security Updates do not receive the update and remain vulnerable.

For Outlook.com, Microsoft provides no further details beyond version number 20260925.100 and a reference to the release notes.

Whether the update is installed can be checked Get-HotFix locally or across multiple computers:

Get-HotFix -Id KB5126655 -ComputerName srv01.example.com, srv02.example.com

If the command returns no result for a computer, the update is missing there. Get-HotFix reads the WMI class Win32_QuickFixEngineering and displays only updates installed through Component Based Servicing.

What is known about exploitation

In the advisory FAQ, Microsoft describes an attack scenario via email or instant message: The attacker sends the victim a crafted file. The attacker cannot force the victim to open the file and must persuade them to click a link or open an attachment. The result is a Mark of the Web bypass. Mark of the Web is the marker Windows attaches to files from the internet; according to CrowdStrike’s analysis, it triggers, among other things, Protected View in Office and the SmartScreen warning for downloaded programs.

Microsoft classifies the vulnerability as exploited and not publicly known before Patch Tuesday. According to Tenable, it is the third exploited Windows Shell vulnerability this year, after CVE-2026-21510 (February) and CVE-2026-32202 (April).

As of October 14, 2026, no public information is available about attackers, campaigns, targets, file types used, or indicators. CISA lists use by ransomware groups as “Unknown.”

Immediate actions

1. Install the update: Install the cumulative October update from the table on all Windows clients and servers, then restart them. Microsoft requires a restart for all entries. Clients with email and chat access should be addressed first because the described attack scenario targets them.

2. Verify installation status: Use Get-HotFix or your own update management to confirm that the update is installed on all devices, and remediate outliers.

3. Address systems without updates: Windows 10 22H2 and Windows Server 2012 R2 without ESU do not receive the update. Enroll these devices in the ESU program, upgrade them to a supported version, or disconnect them from email and chat traffic.

4. Reduce exposure: Since Microsoft does not list a workaround, the only option until the update is installed is to make delivery of crafted files more difficult. Filtering attachments at the mail gateway or in Exchange Online Protection and checking links reduce the number of files that reach users at all. Users should be informed that attacks involving crafted attachments are currently underway.

Checking for compromise

As of October 14, 2026, Microsoft, CISA, and the reviewed analyses do not list any indicators (file names, hashes, IP addresses, or domains). A targeted search for this vulnerability is therefore not possible. In addition to installing the update, CISA requires U.S. federal agencies to perform forensic triage according to the requirements of BOD 26-04.

The update closes the vulnerability but does not undo malware that has already run. The following are therefore advisable:

1. Review alerts from the endpoint security solution (such as Microsoft Defender for Endpoint) from recent weeks for files launched from email attachments, chat messages, or downloads.

2. Review mail gateway and quarantine logs for attachments and links that users reported or released despite warnings.

3. Isolate suspicious devices and preserve logs before remediation so that forensic analysis remains possible.

4. Monitor the advisory: If Microsoft updates the advisory or a security company publishes indicators, repeat the search using them.

Assessment

The Windows Shell is part of every Windows installation; CrowdStrike therefore counts virtually the entire Windows base among the affected systems. The attack scenario relies on the user: An attachment or link delivered by email or chat is enough if the victim opens it. Mark of the Web underpins several Windows and Office security features; a bypass removes warnings users would otherwise see before opening a file. No notice from the National Cyber Security Centre (NCSC) or other European CERTs regarding CVE-2026-96951 could be found as of October 14, 2026.