{"type":"bundle","id":"bundle--7090c6f6-cda7-5845-beb9-a7062d0bbafc","objects":[{"type":"campaign","spec_version":"2.1","id":"campaign--27ffbef6-39cc-5748-aace-1457fe6f3d1e","created":"2026-10-13T19:33:02.945Z","modified":"2026-10-13T19:33:02.945Z","name":"Exploited Windows zero-day lets crafted files skip the Mark of the Web warning (CVE-2026-96951)","description":"Microsoft fixed CVE-2026-96951 in the October 2026 Patch Tuesday release (2026-10-13). It is a command injection (CWE-77) in Windows Shell that lets an unauthorized attacker bypass a security feature over a network; Microsoft's FAQ says the bypassed feature is Mark of the Web (MOTW), so a crafted file sent by email or instant message, or reached through a link, can open without the internet-origin protections. Microsoft rates it Important, CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), marks it Exploitation Detected and not publicly disclosed. CISA added it to the Known Exploited Vulnerabilities catalog the same day with a 2026-10-16 due date. Affected: Windows 10 1607/1809/21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 R2, 2016, 2019, 2022 and 2025. Outlook.com is also listed and was fixed service-side in release 20260925.100.","aliases":["CVE-2026-96951","Windows Shell Security Feature Bypass Vulnerability","Microsoft Windows Command Injection Vulnerability","Windows Mark of the Web bypass October 2026 Patch Tuesday"],"first_seen":"2026-10-13T14:00:00.000Z","last_seen":"2026-10-13T19:28:06.365Z","objective":"Defensive public threat-intelligence record; see limitations and source references.","external_references":[{"source_name":"Microsoft Security Response Center: CVE-2026-96951","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951"},{"source_name":"CISA Known Exploited Vulnerabilities catalog","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"},{"source_name":"CVE-2026-96951 record (CVE List V5)","url":"https://www.cve.org/CVERecord?id=CVE-2026-96951"},{"source_name":"NVD CVE-2026-96951","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96951"},{"source_name":"HOL Guard operator write-up","url":"https://hol.org/blog/cve-2026-96951-windows-shell-mark-of-the-web-bypass"}]}]}