high severityConfidence highHistorical record

Exploited Windows zero-day lets crafted files skip the Mark of the Web warning (CVE-2026-96951)

Microsoft fixed CVE-2026-96951 in the October 2026 Patch Tuesday release (2026-10-13). It is a command injection (CWE-77) in Windows Shell that lets an unauthorized attacker bypass a security feature over a network; Microsoft's FAQ says the bypassed feature is Mark of the Web (MOTW), so a crafted file sent by email or instant message, or reached through a link, can open without the internet-origin protections. Microsoft rates it Important, CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), marks it Exploitation Detected and not publicly disclosed. CISA added it to the Known Exploited Vulnerabilities catalog the same day with a 2026-10-16 due date. Affected: Windows 10 1607/1809/21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 R2, 2016, 2019, 2022 and 2025. Outlook.com is also listed and was fixed service-side in release 20260925.100.

Also tracked as CVE-2026-96951 · Windows Shell Security Feature Bypass Vulnerability · Microsoft Windows Command Injection Vulnerability · Windows Mark of the Web bypass October 2026 Patch Tuesday

First observed
Oct 13, 2026
Last observed
Oct 13, 2026
Last reviewed
Oct 13, 2026
Tracking ended
Oct 13, 2026

Record exports

JSON recordArtifact CSVSTIX 2.1 bundle

Uncertainty and limitations

Read the evidence limits before acting on this record.

Microsoft has not published how the Windows Shell command injection works and no public proof of concept is referenced. The observation that email attachments are the likely common path is HOL's reading of the FAQ and the Outlook.com listing, not a Microsoft statement. MSRC lists fixed build 10.0.19044.7807 for both Windows 10 21H2 and 22H2.

  • Machines already on the fixed October 2026 build are not exposed.
  • Outlook.com users need no action; Microsoft fixed it service-side.
  • macOS, Linux, iOS and Android are not affected; this is Windows Shell.
  • Servers are affected but the attack needs a person opening files, so user endpoints, jump hosts and shared admin machines are the priority.
  • Microsoft lists no workaround; the update is the fix.

Guard coverage and policy

What Guard's reviewed assertions do and do not claim for this campaign, and the reviewed starting points for defense.

No Guard coverage mapping is published for this record.

No campaign-specific policy guidance is published.

Safe next step. Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.

Open policy controlsCampaign-specific emergency policy starting point

Timeline

Reviewed events, oldest first, each tied to a verified source.

  1. Vendor action

    Microsoft published CVE-2026-96951 in the October 2026 security updates, marked Exploitation Detected, with cumulative updates for all affected Windows versions.

  2. Update

    CISA added CVE-2026-96951 (Microsoft Windows Command Injection Vulnerability) to the KEV catalog, due 2026-10-16.

  3. Disclosure

    CVE-2026-96951 published to the CVE List by Microsoft.

  4. Update

    NVD received CVE-2026-96951 with CWE-77; analysis pending.

  5. Update

    HOL Guard published BREAKING operator coverage with the KB and fixed-build table, a PowerShell build check and scope notes.

Publication clock: 0.5 hours from reviewed disclosure timestamp to HOL publication; 24-hour high target; within target.

Reviewed artifacts

The specific artifacts this record concerns, as reviewed. Names and versions are shown as text; a registry link is not recorded here.

  • Windows 11 Version 24H2@>=10.0.26100.0 <10.0.26100.9711windowspackage
  • Windows 11 Version 25H2@>=10.0.26200.0 <10.0.26200.9711windowspackage
  • Windows 11 Version 26H2@>=10.0.26300.0 <10.0.26300.9711windowspackage
  • Windows 11 Version 26H1@>=10.0.28000.0 <10.0.28000.3231windowspackage
  • Windows 11 Version 23H2@>=10.0.22631.0 <10.0.22631.7652windowspackage
  • Windows 10 Version 21H2 / 22H2@<10.0.19044.7807 (MSRC lists 19044.7807 for both)windowspackage
  • Windows 10 1809 / Windows Server 2019@>=10.0.17763.0 <10.0.17763.9376windowspackage
  • Windows 10 1607 / Windows Server 2016@>=10.0.14393.0 <10.0.14393.9612windowspackage
  • Windows Server 2025@>=10.0.26100.0 <10.0.26100.33650windowspackage
  • Windows Server 2022@>=10.0.20348.0 <10.0.20348.5761windowspackage
  • Windows Server 2012 R2@>=6.3.9600.0 <6.3.9600.23470windowspackage

Sources

Every claim on this record is traceable to the sources below.

Reviewed in full by HOL Guard Security Publishing.

Published
Last full review
Last modified

Report a correction

Record HGTC-2026-3DACB649