Windows Shell Mark-of-the-Web bypass zero-day (CVE-2026-96951)
› Microsoft Windows Shell (and related Oct Patch Tuesday components)
Get an email when a new major security incident drops. No spam, unsubscribe any time.
- started
- Oct 13, 2026
- closed
- Oct 13, 2026
- CVEs
- 3
- sources
- 5
## summary
Microsoft’s October 13 2026 Patch Tuesday fixed an actively exploited Windows Shell security-feature bypass, CVE-2026-96951, that can evade Mark of the Web protections (command-injection style neutralization flaw). CISA added it to KEV. Two other publicly disclosed zero-days (.NET Framework WDAC bypass CVE-2026-108398 and MessagePack-CSharp DoS CVE-2026-92707) shipped in the same release.
severity: Important / actively exploited zero-day (MotW bypass); CISA KEV
## cve ids[3]
## affected
- Supported Windows versions receiving the October 2026 cumulative updates (see Microsoft Security Update Guide)
## fixed in
- October 2026 Patch Tuesday cumulative updates (KB packages per SKU)
## timeline[1]
Microsoft ships patches; CISA KEV lists CVE-2026-96951.
## advisories[1]
## news & write-ups[1]
## posts[3]
Patch fast, stay safe. Attackers exploit known flaws within days, like this month's Windows Shell zero-day (CVE-2026-96951) and the Linux "PwnEscape" bug (CVE-2026-99999). Update Windows and Linux today, turn on auto-updates, and use MFA. #CyberSecurity #PatchManagement #InfoSec t.co/WYVnDmsENU
October Patch Tuesday: 1,408 CVEs, 72 critical. Zero-day CVE-2026-96951 (Windows Shell Mark of the Web bypass) is exploited, CISA deadline Oct 16. SharePoint CVE-2026-65660 is also exploited, yet Microsoft's guide still says No. #PatchTuesday #InfoSec
🔴 Patch Windows right now. CVE-2026-96951 — a "Mark of the Web" bypass — is being actively exploited in the wild. A malicious ZIP or ISO can run code on your machine without triggering security warnings. Start → Settings → Windows Update → Check for updates. Don't postpone
## notes & caveats
Microsoft shared almost no technical detail on exploitation. Marked closed because an official patch is available and widely distributed; unpatched endpoints remain exposed.
