TLP:CLEARSECURITY ADVISORYHRK-SA-2026-1031-12Exploited in the wild
Windows Shell Mark of the Web bypass (CVE-2026-96951): a crafted file that evades the warning
A command injection in Windows Shell lets a crafted file bypass Mark of the Web, the tag that tells Windows a file came from the internet. With the mark stripped, SmartScreen, Office Protected View and macro blocking stand down. Microsoft confirms active exploitation, and CISA added it to KEV. Apply the October 2026 update, and prove coverage across the fleet.
SEVERITY
High
PEAK CVSS
8.8
AUTH REQUIRED
None
PUBLIC POC
Reported
PUBLISHED
Oct 31, 2026
REVISION
v1.0 · @Melly
Hayrok Research highlight
Every defense that protects a Windows user from a malicious download rests on one quiet tag: Mark of the Web. It is the reason an email attachment opens in Protected View, the reason SmartScreen warns before a downloaded installer runs, the reason macros stay off by default.
CVE-2026-96951 removes that tag. A single crafted file, delivered by email or chat, slips past the mark entirely. The warning never fires. Protected View never opens. To the user, and to much of the endpoint stack, the file looks like it was always trusted.
This is not theoretical. Microsoft confirms it is already being exploited, CISA added it to the Known Exploited Vulnerabilities catalog within a day of disclosure, and it is the third Windows Shell flaw used in the wild in 2026. The attacker needs no credentials and no privileged access, only for someone to open the file. Mark of the Web bypasses are the quiet first move in phishing-led intrusions, because they turn one click into execution.
01 · EXECUTIVE SUMMARY
Bottom line
Hayrok Research Lab is tracking an actively exploited Windows Shell command injection that bypasses Mark of the Web. A crafted file delivered to a user strips the internet-origin tag, so SmartScreen, Office Protected View and macro blocking do not engage. Microsoft fixed it in the October 2026 security update, and CISA added CVE-2026-96951 to KEV on Oct 13 with a short federal deadline. The control is patch coverage across every Windows endpoint, verified, not assumed.
KEY JUDGMENTS
01
Microsoft confirms active exploitation, and CISA added CVE-2026-96951 to its KEV catalog on Oct 13, 2026 with a federal remediation deadline within days.Observed
02
The flaw is an enabler, not a payload. It removes the warning layer so a phishing attachment runs more easily; impact depends on the payload and the user's privileges.Assessed
03
It is the third Windows Shell flaw exploited in the wild in 2026. The component's patch volume has climbed sharply, so treat Windows Shell as a recurring target.Observed
04
Coverage is the hard part. A fleet-wide Mark of the Web bypass is only closed when every endpoint has the October update, which patch dashboards routinely overstate.Assessed
02 · VULNERABILITY DETAILS
Vulnerability summary
Windows Shell command injection, Mark of the Web bypass
CWE-77 improper neutralization of special elements in a command
Security control defeated
Mark of the Web (SmartScreen, Protected View, macro blocking)
Vector
Crafted file plus user interaction (open the file)
Affected
Windows 10, 11 and Windows Server 2019, 2022 and 2025
Scoring
8.8 · CVSS v3.1, High
Impact
Bypass of internet-origin protections, enabling payload execution.
EXPOSURE: AN UNPATCHED ENDPOINT PLUS A USER
01Affected WindowsWindows 10, 11 or Server 2019 to 2025 without the October update.
02File deliveryA crafted file reaches the user by email, chat or download.
03User opens itThe flaw needs the file to be opened.
04Payload readyWith the mark stripped, downstream defenses do not engage.
03 · THREAT ACTIVITY
Exploitation status and timeline
IN THE WILDObservedMicrosoft confirms exploitation.
CISA KEVListed Oct 13Short federal deadline.
PATTERN3rd in 2026Third exploited Shell flaw this year.
PATCHAvailableOctober 2026 cumulative update.
DISCLOSURE AND ACTIVITY TIMELINE · 2026
Oct 13Microsoft ships the October 2026 update fixing CVE-2026-96951, and confirms active exploitation. CISA adds it to KEV the same day.
ContextIt is one of three zero-days in a record Patch Tuesday of over 1,400 CVEs, and the third Windows Shell flaw exploited in 2026.
OngoingMark of the Web bypasses pair with malicious Office documents, so expect phishing campaigns to fold this in.
04 · AFFECTED PRODUCTS
Affected and fixed versions
This is a client-side flaw across the Windows family. Confirm the exact fixed build and KB number for each OS build against Microsoft's Security Update Guide before deployment.
PRODUCT
AFFECTED
FIXED IN
STATUS
Windows 11
before Oct 2026 update
October 2026 cumulative update
Fixed
Windows 10
before Oct 2026 update
October 2026 cumulative update
Fixed
Windows Server 2019, 2022, 2025
before Oct 2026 update
October 2026 cumulative update
Fixed
Endpoints behind on updates
any missing October
deploy the update
At risk
COVERAGE IS THE RISKA single unpatched laptop reopens the bypass for the user in front of it. The deliverable is not "patch released," it is confirmed coverage across every endpoint, including remote and rarely-connected machines.
05 · RECOMMENDED ACTIONS
What to do, in priority order
CriticalImmediately
All Windows endpoints and serversDeploy the October 2026 cumulative update. Prioritize ahead of the KEV deadline.
High-risk usersPatch finance, executive and helpdesk machines first; they receive the most targeted attachments.
HighWithin the patch window
Remote and rarely-connected machinesChase coverage on laptops that miss the main deployment wave.
Email and chat gatewaysTighten attachment handling so fewer crafted files reach users in the first place.
User awarenessRemind users that a missing warning is not the same as a safe file.
HighBefore closing
The fleetRecord confirmed coverage, not just the patch dashboard percentage, as evidence.
WORKAROUNDS
Patch is the fix. There is no configuration that restores the stripped mark. Deploy the October update.Reduce delivery. Block or sandbox risky attachment types at the email and chat gateway.Harden Office. Keep Protected View and macro blocking enforced by policy so a bypass has less to unlock.Watch for execution. Alert on child processes spawned from Office and from archive or disk-image mounts.
06 · DETECTION AND HUNTING
Observables and hunting queries
The bypass itself is quiet. Hunt on patch coverage and on the execution that follows a file opened without a warning.
TYPE
OBSERVABLE
SOURCE
Exposure
An endpoint missing the October 2026 cumulative update
Patch management, Get-HotFix
Behavior
Office or Shell spawning a script host or command interpreter
EDR process telemetry
Behavior
Execution from a mounted archive, ISO or container file
EDR, Windows event logs
EXPOSURE · CVE-2026-96951is the October update present
Mark of the Web is a small marker Windows attaches to files from untrusted locations, stored as an alternate data stream. Downstream defenses read it: SmartScreen warns before a marked executable runs, Office opens marked documents in Protected View, and macros in marked documents stay blocked. The whole model assumes the mark is present and honored.
CVE-2026-96951 is a command injection in Windows Shell, classed as improper neutralization of special elements in a command (CWE-77). A crafted file exploits that handling so the Shell does not apply or honor the mark, which means the file is treated as though it did not come from the internet. The flaw does not run code by itself; it removes the warning layer, so a phishing attachment or downloaded installer runs with far less friction. That is why Microsoft and CISA rate it urgent despite the user-interaction requirement: it is the enabler at the front of a familiar intrusion chain.
01 DELIVER
A crafted file reaches a user by email or chat
Control: Block or sandbox risky attachments at the gateway
02 BYPASS
Windows Shell fails to apply Mark of the Web
Control: October 2026 cumulative update
03 OPEN
No SmartScreen warning, no Protected View
Control: Enforce Protected View and macro blocking
A .NET Framework mitigation bypass publicly disclosed in the same Patch Tuesday. No shared chain established.
AssessedA Mark of the Web bypass is the quiet first move in phishing-led intrusions. It turns one click into execution, and only fleet-wide patch coverage closes it.
09 · VALIDATION
Confirm remediation
A patch dashboard percentage is not a verdict. Each endpoint should end with evidence: the October update confirmed present, or flagged for deployment.
01
Confirm the October update per host
Across every Windows endpoint and server, including remote machines.
This advisory will be updated as exploitation activity or vendor guidance changes.
12 · FAQ
Is CVE-2026-96951 being exploited?
Yes. Microsoft confirms active exploitation, and CISA added it to the KEV catalog on October 13, 2026 with a short federal deadline.
What does the flaw actually do?
It is a Windows Shell command injection that bypasses Mark of the Web, the tag that marks files from the internet. With the mark gone, SmartScreen, Protected View and macro blocking do not engage.
Does it run code on its own?
No. It requires a user to open a crafted file. Its value to an attacker is removing the warning layer, so the payload runs with less friction.
How do we fix it?
Deploy the October 2026 cumulative update to every Windows endpoint and server, and verify coverage rather than trusting the dashboard.
VALIDATE YOUR EXPOSURE
Prove your Mark of the Web coverage
Hayrok confirms the October update per endpoint, finds the machines the dashboard overstates, and tests whether a bypassed file would still trigger your downstream defenses. Every result lands in Evidence Fabric.