BREAKING: Windows zero-day lets booby-trapped files skip the download warning (CVE-2026-96951)

Attackers are already using a Windows bug that lets a booby-trapped file skip the "this came from the internet" warning. Microsoft fixed it today in the October 2026 Patch Tuesday release as CVE-2026-96951, a Windows Shell flaw it marks Exploitation Detected. CISA added it to the Known Exploited Vulnerabilities catalog the same day, with an October 16 deadline for federal agencies. Every supported Windows 10, Windows 11 and Windows Server build from 2012 R2 to 2025 is on the list.

Microsoft's description is short: a command injection in Windows Shell lets an attacker "evade Mark of the Web (MOTW) defenses." Mark of the Web is the tag Windows puts on files that arrive from a browser or an email client. It is what makes SmartScreen ask "Do you want to run this file?" and what opens Office documents in Protected View. A file that loses that tag opens like something you created yourself. That is why bugs in this class keep showing up in phishing campaigns: they are the piece that turns "the user saw a warning and stopped" into "the payload ran."

This post is our operator read of Microsoft's advisory and the CISA KEV entry. The HOL Guard evidence pack for CVE-2026-96951 is the source record.

How to fix

Install the October 2026 cumulative update. Microsoft lists no workaround or mitigation for this one, so the update is the fix. On a single machine that is Settings, Windows Update, Check for updates, then a restart. For fleets, approve these KBs in WSUS, Intune or Configuration Manager and make sure the restart actually happens:

Server Core installations take the same KB as the full install of that version.

How the attack reaches someone

Microsoft's FAQ describes the delivery plainly: the attacker sends a specially crafted file by email or instant message, or gets the user to click a link to a site they control. Nobody can be hit without doing something. Someone has to open the file or follow the link. The CVSS vector Microsoft published says the same thing (network attack, no privileges, user interaction required, 8.8).

One detail in the affected product list is worth noticing. Microsoft also lists Outlook.com, fixed on the service side in release 20260925.100. Outlook.com users do not need to do anything, but it tells you the crafted file travels well through webmail. Expect the attachment, not a drive-by page, to be the common path.

Microsoft has not published how the injection works, and no public proof of concept is referenced. Publicly disclosed is marked No. So the people using this today are the ones who found it, and defenders have less to go on than usual. That is a reason to patch first and hunt later.

Who is not in scope

• Machines that already show the fixed build in the table above. The October cumulative update carries the fix.
• Outlook.com mailboxes. Microsoft fixed that part on its side in September.
• macOS, Linux, iOS and Android. This is Windows Shell, so a Mac user opening the same attachment is not exposed to this bug.

Servers are listed, but the attack needs a person opening files from email or the web. Patch them on the normal October schedule. The urgent group is laptops and desktops where people read mail, plus jump hosts and shared admin machines where people download tools.

One operator check

Check the build on any machine you care about. In PowerShell:

$v = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
"$($v.CurrentBuild).$($v.UBR)"

Compare the result with the fixed build in the table. A Windows 11 24H2 machine should read 26100.9711 or higher. Anything lower still needs the October update, even if Windows Update says it is "up to date" and is just waiting for a restart.

If you want to see what Mark of the Web looks like on a file you downloaded, read its Zone.Identifier stream:

Get-Content -Path .\Downloads\example.zip -Stream Zone.Identifier

ZoneId=3 means Windows knows it came from the internet. That tag is the thing this bug lets an attacker get around, so on an unpatched machine its presence on the download does not guarantee you will see a warning when the file is opened.

If AI agents use your Windows machines

Browser agents and computer-use agents that download files and open them on Windows hosts lean on the same warnings a person does, and they are easier to talk into opening an attachment. Patch the hosts they run on in the first wave, not the last. HOL Guard sits in front of the agent's actions and pauses risky ones, such as running a file the agent just fetched, until a person decides. It does not replace the Windows update.

What this is not

This is not a zero-click worm. Someone has to open a crafted file or click a link, and Microsoft classes the bug as a security feature bypass rather than remote code execution. It is still being used in real attacks today, which is why it belongs at the top of this month's Patch Tuesday list.

References

• Microsoft Security Response Center: CVE-2026-96951
• CISA Known Exploited Vulnerabilities catalog (added 2026-10-13, due 2026-10-16)
• NVD: CVE-2026-96951
• CVE.org record