Table of contents
19
Read this in 30 seconds: CVE-2026-96951 lets a crafted file skip the warnings Windows shows for downloaded files, and Microsoft says attackers were already using it when the patch shipped. It is the third Windows Shell bug exploited in 2026, and nobody has published how it works.
- It removes the warning, not the user. Microsoft’s record says the flaw lets an attacker “evade Mark of the Web (MOTW) defenses”, and the victim still has to open the file. CVSS 3.1 is 8.8 and Microsoft’s severity is Important.
- Exploited when it shipped. Microsoft’s record says exploited: Yes, publicly disclosed: No. CISA listed it the same day, October 13, with an October 16 deadline and the forensic triage flag.
- It is the third in eight months. CVE-2026-21510 came in February, and CVE-2026-32202 in April, which Akamai calls an incomplete patch of the first and Microsoft re-released on July 28.
- The public record has holes. We found no analysis of the mechanism, no attribution, and sources disagree on who reported it.
- The fix is a build number. Windows 11 24H2 needs 10.0.26100.9711 or later, and Windows 10 22H2 needs 10.0.19045.7807.
A Mark of the Web bypass does not break into a computer. It removes the one speed bump that makes people hesitate before opening a file.
CVE-2026-96951 is easy to underrate: it needs a person to click, it carries an 8.8, and Microsoft calls it Important. This article covers what the bug removes, how the three 2026 Shell bugs connect, what the public record does not say, and how to check that your builds are fixed.
Microsoft published the advisory on October 13, 2026, titled “Windows Shell Security Feature Bypass Vulnerability”. The description says improper neutralization of special elements used in a command, a command injection, in Windows Shell “allows an unauthorized attacker to bypass a security feature over a network.”
We read the record through Microsoft’s update-guide data, NVD and the CISA KEV JSON:
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, with a temporal score of 8.2. The scores come from Microsoft. NVD lists the record as Analyzed but carries no score of its own.The security feature in question is Mark of the Web. Microsoft’s FAQ says an attacker “could evade Mark of the Web (MOTW) defenses.”
Windows tags files that arrive from the internet with a hidden NTFS stream called Zone.Identifier. Eric Lawrence’s long-running explainer on downloads and the Mark of the Web lists what that tag triggers:
.js, .lnk, .bat and .dll under Smart App Control on Windows 11.A file that loses its tag, or never gets one, skips all of that and behaves like a file you made yourself. That is the whole value of a bypass like CVE-2026-96951: every defense downstream of the tag quietly turns off.
Microsoft’s FAQ describes two routes. In an email or instant message attack, the attacker sends the target “a specially crafted file that is designed to exploit the vulnerability.” In any case, Microsoft says, the attacker “would have no way to force a user to view attacker-controlled content”, so they must convince the user to click a link or open an attachment.
Help Net Security adds that the file could arrive through email, instant messages, collaboration tools such as Teams and Slack, or a malicious website. It also says the file opens without Protected View and without a block.
That framing explains the score. UI:R means the user must act, which holds it at 8.8, and it explains CISA’s “automatable: no” tag. But a crafted file sent by email or chat is exactly the lure attackers use, and a bypass like this one makes that file look ordinary.
Tenable’s Satnam Narang, quoted by Help Net Security, called CVE-2026-96951 “the third flaw in Windows Shell that was exploited in the wild this year.” We checked each one against Microsoft’s records and the KEV feed.
| CVE-2026-21510 | CVE-2026-32202 | CVE-2026-96951 | |
|---|---|---|---|
| Microsoft title | Shell Security Feature Bypass | Shell Spoofing | Shell Security Feature Bypass |
| Released | Feb 10, 2026 | Apr 14, 2026 | Oct 13, 2026 |
| CVSS 3.1 | 8.8 | 4.3 | 8.8 |
| Weakness | Protection mechanism failure | Protection mechanism failure | Command injection |
| Publicly disclosed | Yes | No | No |
| KEV added, due | Feb 10, Mar 3 | Apr 28, May 12 | Oct 13, Oct 16 |
The gaps are 63 days from the first to the second, 182 days from the second to the third, and 245 days from the first to the third.
Akamai’s analysis, published April 23, says CVE-2026-21510 was part of an APT28 chain that bypassed SmartScreen and ran attacker-controlled code, and that Microsoft’s February fix missed a step. Explorer resolved a network path before any trust check ran, so a victim machine could still authenticate to an attacker’s server. That residue became CVE-2026-32202.
Microsoft’s own record shows the follow-through. It corrected CVE-2026-32202’s exploited flag and CVSS vector on April 27, then re-released the CVE on July 28 “to comprehensively address the vulnerability” and recommended the July 2026 updates.
So two of the three form a pair. Whether CVE-2026-96951 belongs to the same family is the open question, and Narang says it is unclear whether it is linked to APT28 or to another incomplete fix.
This section matters more than usual, because the gaps are large.
We also could not verify the claim in one outlet that Windows 10 machines outside the Extended Security Updates program do not receive the fix. It fits the build list below, which covers only supported Windows 10 servicing branches.
If you run Windows, almost certainly yes until you install the October 13 updates. Born City, citing Microsoft, says all supported Windows client and server versions are affected. NVD’s configuration data also lists Outlook Web.
These are the first fixed builds, taken from NVD’s configuration data:
| Product | Fixed in build |
|---|---|
| Windows 11 25H2 | 10.0.26200.9711 |
| Windows 11 24H2 | 10.0.26100.9711 |
| Windows 11 23H2 | 10.0.22631.7652 |
| Windows 11 26H1 | 10.0.28000.3231 |
| Windows 11 26H2 | 10.0.26300.9711 |
| Windows 10 22H2 | 10.0.19045.7807 |
| Windows 10 21H2 | 10.0.19044.7807 |
| Windows 10 1809 | 10.0.17763.9376 |
| Windows 10 1607 | 10.0.14393.9612 |
| Windows Server 2025 | 10.0.26100.33650 |
| Windows Server 2022 | 10.0.20348.5761 |
| Windows Server 2019 | 10.0.17763.9376 |
| Windows Server 2016 | 10.0.14393.9612 |
Windows Server 2012 is also listed as affected without a build number in NVD’s data, so check Microsoft’s advisory for that branch.
Your real exposure to CVE-2026-96951 depends on who can receive a file. A server nobody opens attachments on is a lower priority than a laptop that handles email, Teams and Slack all day.
CISA flagged the CVE-2026-96951 KEV entry for forensic triage, so patching is the first step and not the last.
winver shows it as the OS Build, and PowerShell can read it from the registry:$v = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion"
"$($v.CurrentBuild).$($v.UBR)"Microsoft published no indicators and no file hashes for CVE-2026-96951, and we found none elsewhere. Born City reports that Sigma rules and KQL queries exist, and we have not reviewed them.
What a hunter can do is look for the consequence: files from internet sources that arrived without a tag. This is our own coarse heuristic, and it is noisy.
# Files in Downloads with no Zone.Identifier stream (candidates, not proof)
Get-ChildItem "$env:USERPROFILE\Downloads" -File -Recurse |
Where-Object { -not (Get-Item $_.FullName -Stream Zone.Identifier -ErrorAction SilentlyContinue) } |
Select-Object FullName, LastWriteTimeMany legitimate files lack the tag. Lawrence’s explainer lists the usual reasons: copies to FAT drives, extraction by tools that do not propagate the mark, and downloads with curl or scripts. Use the result to ask which untagged files arrived by email or chat, and look at those first.
The KEV catalog is easy to search for a technique by name, and that search misleads here. We queried the live JSON: 12 entries are named for Mark of the Web or SmartScreen bypasses, from November 2022 to February 2025. None of the 2026 Shell entries appears under that name. CVE-2026-21510 is filed as “Protection Mechanism Failure”, and CVE-2026-96951 as “Command Injection”.
So a dashboard filtering on “Mark of the Web” shows nothing new for 2026, while three exploited Shell bugs sit outside the filter. Microsoft also accounts for 40 of the 272 entries added to KEV in 2026.
If you track exploited bugs by technique, search the descriptions and Microsoft’s own titles as well. Our post on CVE-2025-61624 covers a similar scoring blind spot, a medium-rated bug that mattered because of the chain around it.
Quick disclosure: we sell offensive testing, so read this with that in mind.
A penetration test cannot tell you whether a user will open a crafted file, and we will not claim it can. What testing can do is check what a successful file would reach: endpoint controls, attachment filtering and how far one compromised laptop gets. Our AI VAPT services cover that, and managed engagements start at $2,500 on the pricing page. Red teaming is scoped individually.
Our terms say AI output can be incomplete or wrong, so a person reviews anything you would act on. XHack does not store your agent chats and cannot access them.
CVE-2026-96951 is a command injection (CWE-77) in Windows Shell that lets a crafted file evade Mark of the Web defenses. Microsoft rates it Important with a CVSS 3.1 score of 8.8, and its record says it is exploited. The user must open the file.
Yes. Microsoft’s record says exploited: Yes and “Exploitation Detected”. CISA added it to KEV on October 13, 2026, with an October 16 deadline and the forensic triage flag. No attribution or campaign details have been published.
It lets a file skip the warnings Windows attaches to downloads, such as SmartScreen checks, Protected View for Office documents and prompts for risky file types. It does not run the file for the attacker. A person still has to open it.
Born City, citing Microsoft, says all supported Windows client and server versions are affected. NVD lists Windows 10 and 11 and Windows Server 2012 through 2025, and the fixed builds are in the table above, such as 10.0.26100.9711 for Windows 11 24H2.
Unknown. APT28 was tied to CVE-2026-21510 by Akamai, and CVE-2026-32202 was an incomplete patch of it, but no public source ties CVE-2026-96951 to APT28 or to any actor. Tenable’s Narang says it is unclear.
Confirm your Windows build is at or above the fixed build for your version, then review files that arrived without a Zone.Identifier tag from email or chat. No indicators of compromise have been published, so the file check is a heuristic.
CVE-2026-96951 removes a warning, not a person, which is why it scores 8.8 and still matters. Microsoft says it was exploited when the patch shipped, and it is the third exploited Windows Shell bypass of 2026.
Install the October updates, patch the machines that open outside files first, and do not treat Protected View as a control that this bug leaves intact. Then watch the earlier Shell bugs for a pattern: two of them were linked, and nobody has said yet whether this one makes three.
Categories
Related articles
