CVE-2026-96951, Windows Shell: a Mark of the Web bypass exploited as a zero-day, fixed in the 2026-10-13 cumulative updates and listed in CISA KEV (CVSS 8.8)

Microsoft's 2026-10-13 release fixes CVE-2026-96951, a Windows Shell security feature bypass that Microsoft marks as exploited and not publicly disclosed (Microsoft Security Response Center, 2026-10-13); CISA added it to its Known Exploited Vulnerabilities catalog the same day, citing evidence of active exploitation (CISA, 2026-10-13). Microsoft says an attacker who exploits it could evade Mark of the Web defenses, by sending a crafted file by email or instant message or enticing the user to click a link or open an attachment (Microsoft Security Response Center, 2026-10-13). Microsoft's record gives the root cause as improper neutralization of special elements in a command (command injection, CWE-77) (Microsoft Security Response Center, 2026-10-13). Rapid7 describes the effect as Windows not showing the dialog that says it protected the PC, because the tag that triggers it is bypassed, calls this the second exploited Windows Shell zero-day this year, and says the flaw also affected Outlook.com, patched in a build several weeks ago (Rapid7, 2026-10-13). Rapid7 says Windows Server 2012 receives no patch while Server 2012 R2 does (Rapid7, 2026-10-13), and Microsoft's record lists no Windows Server 2012 product for this flaw (Microsoft Security Response Center, 2026-10-13).

Triage: a file a user created or received from a trusted local source also carries no tag; the discriminator is an internet origin (mail, chat or web download) together with the absence of the tag on the opened item.