Windows CVE-2026-96951 Strips Mark of the Web Warnings, and Microsoft Confirms It Was Exploited Before the October 13 Fix

A crafted file or link can strip Windows' Mark of the Web warning from a download, and Microsoft confirmed attackers were already doing it when the fix shipped on October 13. The flaw, CVE-2026-96951 in Windows Shell, scores 8.8, affects every supported version of Windows client and server, and needs the user to open the file or click the link.

CISA added it to the Known Exploited Vulnerabilities catalogue the same day, with a federal due date of October 16.

What the bypass removes

Mark of the Web is the tag Windows attaches to files that came from the internet. CrowdStrike says it is what triggers Protected View and SmartScreen warnings, and Lansweeper says a bypass leaves downloaded or emailed files without their usual internet-origin warnings. The bypass is not code execution on its own. It removes the prompt that stands between a delivered file and the person who would otherwise be asked whether to open it.

Lansweeper describes the flaw as a command injection in Windows Shell that produces a security feature bypass. Exploitation is over the network, needs no privileges, and relies on a user opening a crafted attachment sent by email or instant message, or following a link to an attacker's site. CISA's entry classes it as CWE-77, command injection.

What Microsoft has and has not said

CrowdStrike's analysis of the October release says "Microsoft confirms the flaw is being exploited in the wild," and Lansweeper calls it the only vulnerability that month Microsoft confirmed as actively exploited. It was not publicly disclosed before the patch.

CyberInsider wrote that Microsoft "has not disclosed details of the observed attacks," so who is using it, against whom and with what payload is not public. CyberInsider lists the credited finders as Fujitsu researchers Riku Bamba and Yuya Chudo, Anthropic's Benoit Sevens (using Claude) and a researcher identified as yhw. Credit in a Microsoft advisory does not mean those people observed the exploitation, and no source reviewed says they did.

Patches and the October release

CyberInsider lists the fix as KB5127648 for Windows versions 24H2, 25H2 and 26H2, and KB5127646 for version 26H1. Microsoft's own advisory page was not retrievable for this report, so check it for the other supported builds and Windows Server.

The flaw sat in a large release. CrowdStrike counts 1,413 CVEs with 75 rated critical, while Lansweeper counts 1,410 fixes with 70 critical. The sources do not agree on the total.

Item	CVE	CVSS	Status per CrowdStrike
Windows Shell security feature bypass	CVE-2026-96951	8.8	Exploited
.NET Framework WDAC bypass	CVE-2026-108398	8.8	Publicly disclosed
MessagePack-CSharp denial of service	CVE-2026-92707	5.3	Publicly disclosed

Why a bypass with an 8.8 deserves the deadline

A score of 8.8 on a flaw that needs a click can look like routine volume. The three-day deadline is the signal. Under CISA's BOD 26-04 directive, an entry with the forensic-triage flag requires the agency to remediate within three days and examine the asset for compromise. The catalogue sets that flag to "Yes" for CVE-2026-96951.

CISA's catalogue added the Windows flaw on the same day as a Connect Secure VPN flaw, and a day before the PAN-OS and Cisco gateway listings and the two Ahsay flaws. All carry a three-day window.

What to do

Install the October 13 cumulative update for your build and confirm it against Microsoft's advisory. Where patching has to wait, treat inbound attachments and links from email and chat as untrusted whether or not Windows showed a warning, because for this flaw the absence of a warning proves nothing.