{
  "schemaVersion": "guard-threat-campaign/v1",
  "id": "HGTC-2026-3DACB649",
  "slug": "cve-2026-96951-windows-shell-mark-of-the-web-bypass",
  "title": "Exploited Windows zero-day lets crafted files skip the Mark of the Web warning (CVE-2026-96951)",
  "aliases": [
    "CVE-2026-96951",
    "Windows Shell Security Feature Bypass Vulnerability",
    "Microsoft Windows Command Injection Vulnerability",
    "Windows Mark of the Web bypass October 2026 Patch Tuesday"
  ],
  "summary": "Microsoft fixed CVE-2026-96951 in the October 2026 Patch Tuesday release (2026-10-13). It is a command injection (CWE-77) in Windows Shell that lets an unauthorized attacker bypass a security feature over a network; Microsoft's FAQ says the bypassed feature is Mark of the Web (MOTW), so a crafted file sent by email or instant message, or reached through a link, can open without the internet-origin protections. Microsoft rates it Important, CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), marks it Exploitation Detected and not publicly disclosed. CISA added it to the Known Exploited Vulnerabilities catalog the same day with a 2026-10-16 due date. Affected: Windows 10 1607/1809/21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 R2, 2016, 2019, 2022 and 2025. Outlook.com is also listed and was fixed service-side in release 20260925.100.",
  "status": "published",
  "severity": "high",
  "confidence": "high",
  "uncertainty": "Microsoft has not published how the Windows Shell command injection works and no public proof of concept is referenced. The observation that email attachments are the likely common path is HOL's reading of the FAQ and the Outlook.com listing, not a Microsoft statement. MSRC lists fixed build 10.0.19044.7807 for both Windows 10 21H2 and 22H2.",
  "firstObservedAt": "2026-10-13T14:00:00.000Z",
  "lastObservedAt": "2026-10-13T19:28:06.365Z",
  "publishedAt": "2026-10-13T19:33:02.945Z",
  "reviewedAt": "2026-10-13T19:32:57.565Z",
  "expiresAt": "2026-10-13T19:28:06.365Z",
  "reviewer": "HOL Guard Security Publishing",
  "sources": [
    {
      "id": "msrc",
      "label": "Microsoft Security Response Center: CVE-2026-96951",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951",
      "sourceType": "vendor_advisory",
      "observedAt": "2026-10-13T14:00:00.000Z"
    },
    {
      "id": "cisa-kev",
      "label": "CISA Known Exploited Vulnerabilities catalog",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "sourceType": "government",
      "observedAt": "2026-10-13T00:00:00.000Z"
    },
    {
      "id": "cve-record",
      "label": "CVE-2026-96951 record (CVE List V5)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96951",
      "sourceType": "vulnerability_database",
      "observedAt": "2026-10-13T19:01:26.801Z"
    },
    {
      "id": "nvd",
      "label": "NVD CVE-2026-96951",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96951",
      "sourceType": "vulnerability_database",
      "observedAt": "2026-10-13T19:22:07.760Z"
    },
    {
      "id": "hol-blog",
      "label": "HOL Guard operator write-up",
      "url": "https://hol.org/blog/cve-2026-96951-windows-shell-mark-of-the-web-bypass",
      "sourceType": "other_primary",
      "observedAt": "2026-10-13T19:28:06.365Z"
    }
  ],
  "artifacts": [
    {
      "id": "win11-24h2",
      "artifactClass": "package",
      "ecosystem": "windows",
      "name": "Windows 11 Version 24H2",
      "version": ">=10.0.26100.0 <10.0.26100.9711",
      "defanged": false
    },
    {
      "id": "win11-25h2",
      "artifactClass": "package",
      "ecosystem": "windows",
      "name": "Windows 11 Version 25H2",
      "version": ">=10.0.26200.0 <10.0.26200.9711",
      "defanged": false
    },
    {
      "id": "win11-26h2",
      "artifactClass": "package",
      "ecosystem": "windows",
      "name": "Windows 11 Version 26H2",
      "version": ">=10.0.26300.0 <10.0.26300.9711",
      "defanged": false
    },
    {
      "id": "win11-26h1",
      "artifactClass": "package",
      "ecosystem": "windows",
      "name": "Windows 11 Version 26H1",
      "version": ">=10.0.28000.0 <10.0.28000.3231",
      "defanged": false
    },
    {
      "id": "win11-23h2",
      "artifactClass": "package",
      "ecosystem": "windows",
      "name": "Windows 11 Version 23H2",
      "version": ">=10.0.22631.0 <10.0.22631.7652",
      "defanged": false
    },
    {
      "id": "win10-21h2-22h2",
      "artifactClass": "package",
      "ecosystem": "windows",
      "name": "Windows 10 Version 21H2 / 22H2",
      "version": "<10.0.19044.7807 (MSRC lists 19044.7807 for both)",
      "defanged": false
    },
    {
      "id": "win10-1809-ws2019",
      "artifactClass": "package",
      "ecosystem": "windows",
      "name": "Windows 10 1809 / Windows Server 2019",
      "version": ">=10.0.17763.0 <10.0.17763.9376",
      "defanged": false
    },
    {
      "id": "win10-1607-ws2016",
      "artifactClass": "package",
      "ecosystem": "windows",
      "name": "Windows 10 1607 / Windows Server 2016",
      "version": ">=10.0.14393.0 <10.0.14393.9612",
      "defanged": false
    },
    {
      "id": "ws2025",
      "artifactClass": "package",
      "ecosystem": "windows",
      "name": "Windows Server 2025",
      "version": ">=10.0.26100.0 <10.0.26100.33650",
      "defanged": false
    },
    {
      "id": "ws2022",
      "artifactClass": "package",
      "ecosystem": "windows",
      "name": "Windows Server 2022",
      "version": ">=10.0.20348.0 <10.0.20348.5761",
      "defanged": false
    },
    {
      "id": "ws2012r2",
      "artifactClass": "package",
      "ecosystem": "windows",
      "name": "Windows Server 2012 R2",
      "version": ">=6.3.9600.0 <6.3.9600.23470",
      "defanged": false
    }
  ],
  "indicators": [],
  "timeline": [
    {
      "id": "msrc-release",
      "occurredAt": "2026-10-13T14:00:00.000Z",
      "eventType": "vendor_action",
      "summary": "Microsoft published CVE-2026-96951 in the October 2026 security updates, marked Exploitation Detected, with cumulative updates for all affected Windows versions.",
      "sourceIds": [
        "msrc"
      ]
    },
    {
      "id": "kev-add",
      "occurredAt": "2026-10-13T00:00:00.000Z",
      "eventType": "other",
      "summary": "CISA added CVE-2026-96951 (Microsoft Windows Command Injection Vulnerability) to the KEV catalog, due 2026-10-16.",
      "sourceIds": [
        "cisa-kev"
      ]
    },
    {
      "id": "cve-published",
      "occurredAt": "2026-10-13T19:01:26.801Z",
      "eventType": "disclosure",
      "summary": "CVE-2026-96951 published to the CVE List by Microsoft.",
      "sourceIds": [
        "cve-record"
      ]
    },
    {
      "id": "nvd-received",
      "occurredAt": "2026-10-13T19:22:07.760Z",
      "eventType": "other",
      "summary": "NVD received CVE-2026-96951 with CWE-77; analysis pending.",
      "sourceIds": [
        "nvd"
      ]
    },
    {
      "id": "hol-publish",
      "occurredAt": "2026-10-13T19:28:06.365Z",
      "eventType": "other",
      "summary": "HOL Guard published BREAKING operator coverage with the KB and fixed-build table, a PowerShell build check and scope notes.",
      "sourceIds": [
        "hol-blog"
      ]
    }
  ],
  "coverage": [],
  "policies": [],
  "limitations": [
    "Machines already on the fixed October 2026 build are not exposed.",
    "Outlook.com users need no action; Microsoft fixed it service-side.",
    "macOS, Linux, iOS and Android are not affected; this is Windows Shell.",
    "Servers are affected but the attack needs a person opening files, so user endpoints, jump hosts and shared admin machines are the priority.",
    "Microsoft lists no workaround; the update is the fix."
  ],
  "correctionHref": "/guard/security/campaigns/cve-2026-96951-windows-shell-mark-of-the-web-bypass/corrections"
}