--- schema: 1 kind: vulnerability title: "CVE-2026-96951, Windows Shell: a Mark of the Web bypass exploited as a zero-day, fixed in the 2026-10-13 cumulative updates and listed in CISA KEV (CVSS 8.8)" headline: "Microsoft patches an exploited Windows Shell zero-day that evades Mark of the Web protections on files and links" summary: > Microsoft's 2026-10-13 updates fix CVE-2026-96951, a Windows Shell flaw that lets an attacker evade Mark of the Web defenses once a user opens a crafted file or link sent by email or instant message, so Windows does not show the dialog the tag normally triggers. Microsoft marks it exploited and CISA added it to KEV the same day; no source names the actor, the payload or the victims. Rapid7 says Windows Server 2012 gets no patch, while Microsoft lists fixes for Server 2012 R2 and every later supported release. discovered_at: "2026-10-14T03:39:00Z" updated_at: null event_date: "2026-10-13" run_id: 2026-10-14T0255Z-intel priority: high immediate_action: null tags: [vulnerabilities, zero-day, actively-exploited, cisa-kev, patch-available] regions: [global] sectors: [technology] entities: ["product:microsoft-windows", "product:microsoft-windows-server"] techniques: [T1553.005, T1204.002, T1566.001, T1566.002] affected_products: ["Microsoft Windows", "Microsoft Windows Server"] cves: - id: CVE-2026-96951 cvss: "8.8" epss: null type: logic-flaw vector: user-interaction auth: pre-auth status: [exploited, cisa-kev, patch-available] affected: "Windows 10, Windows 11 and Windows Server 2012 R2 through 2025; Microsoft's record lists no Windows Server 2012 product, and Rapid7 says Server 2012 receives no patch" fixed: "KB5127648 (Windows 11 24H2, 25H2, 26H2), KB5127646 (26H1), KB5126653 (23H2), KB5126657 (Windows 10 21H2, 22H2), KB5126651 (Windows 10 1809, Server 2019), KB5126868 (Windows 10 1607, Server 2016), KB5126655 (Server 2022), KB5126646 (Server 2025), KB5126836 (Server 2012 R2)" sources: - url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951" publisher: "Microsoft Security Response Center" date: "2026-10-13" role: primary - url: "https://www.rapid7.com/blog/post/em-patch-tuesday-october-2026" publisher: "Rapid7" date: "2026-10-13" role: corroborating - url: "https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-adds-two-known-exploited-vulnerabilities-catalog" publisher: "CISA" date: "2026-10-13" role: corroborating closed_sources: [] evidence: - quote: "An attacker who successfully exploited the vulnerability could evade Mark of the Web (MOTW) defenses." publisher: "Microsoft Security Response Center" source_url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951" - quote: "Once again, the immediate prize for an attacker is a Mark of the Web (MOTW) bypass." publisher: "Rapid7" source_url: "https://www.rapid7.com/blog/post/em-patch-tuesday-october-2026" - quote: "Windows Server 2012 doesn’t receive a patch, although Server 2012 R2 does." publisher: "Rapid7" source_url: "https://www.rapid7.com/blog/post/em-patch-tuesday-october-2026" verification: multi-source sourcing_note: "Microsoft's exploitation flag and the fixed builds come from its own security update record; CISA's KEV listing rests on its own statement of active exploitation. No source describes the exploitation campaign." confidence: high references: - 2026-09-09/windows-september-2026-two-exploited-lpe-zero-days-kev deep_dive: false deep_dive_category: null org_triage: null classification: reliability: A credibility: 2 watchlist_hit: false actions: - "Deploy the 2026-10-13 cumulative update for each release (KB5127648 for Windows 11 24H2, 25H2 and 26H2, KB5127646 for Windows 11 26H1, KB5126657 for Windows 10 21H2 and 22H2, KB5126655 for Server 2022, KB5126646 for Server 2025, and the others listed in the CVE record) to every Windows endpoint and server, starting with the systems whose users open mail and chat attachments or download files; Rapid7 says Windows Server 2012 receives no patch." updates: [] migrated_from: null --- Microsoft's 2026-10-13 release fixes CVE-2026-96951, a Windows Shell security feature bypass that Microsoft marks as exploited and not publicly disclosed ([Microsoft Security Response Center, 2026-10-13](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951)); CISA added it to its Known Exploited Vulnerabilities catalog the same day, citing evidence of active exploitation ([CISA, 2026-10-13](https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-adds-two-known-exploited-vulnerabilities-catalog)). Microsoft says an attacker who exploits it could evade Mark of the Web defenses, by sending a crafted file by email or instant message or enticing the user to click a link or open an attachment ([Microsoft Security Response Center, 2026-10-13](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951)). Microsoft's record gives the root cause as improper neutralization of special elements in a command (command injection, CWE-77) ([Microsoft Security Response Center, 2026-10-13](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951)). Rapid7 describes the effect as Windows not showing the dialog that says it protected the PC, because the tag that triggers it is bypassed, calls this the second exploited Windows Shell zero-day this year, and says the flaw also affected Outlook.com, patched in a build several weeks ago ([Rapid7, 2026-10-13](https://www.rapid7.com/blog/post/em-patch-tuesday-october-2026)). Rapid7 says Windows Server 2012 receives no patch while Server 2012 R2 does ([Rapid7, 2026-10-13](https://www.rapid7.com/blog/post/em-patch-tuesday-october-2026)), and Microsoft's record lists no Windows Server 2012 product for this flaw ([Microsoft Security Response Center, 2026-10-13](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951)). **Exposure:** Windows 10, Windows 11 and Windows Server 2012 R2 through 2025 where users open files or links from mail, chat or the web; the fixed build per release is in the CVE record, and Rapid7 reports no patch for Windows Server 2012. **Detection:** Microsoft, CISA and Rapid7 name no actor, payload or victims and no source describes the exploit's behavior, so this is a hunt hypothesis that follows from the mechanism: the failed control is the Mark of the Web tag, so there is no warning dialog for a user to report. Look at mail gateway, chat and endpoint file-origin telemetry for internet-origin files, archives and shortcuts that execute without the usual download warning, and at process lineage from `explorer.exe` into scripting interpreters and living-off-the-land binaries shortly after a mail or browser download. **Triage:** a file a user created or received from a trusted local source also carries no tag; the discriminator is an internet origin (mail, chat or web download) together with the absence of the tag on the opened item. **Defender takeaway:** install the October cumulative update now, ahead of the monthly cycle, on endpoints that open mail and web downloads first; because the tag is the control that failed, attachment blocking and mail-gateway detonation remain the compensating layer until the update is deployed, and Rapid7 reports no patch for Windows Server 2012.