Windows Shell zero-day CVE-2026-96951 bypasses Mark of the Web

Microsoft confirmed active exploitation of CVE-2026-96951 in Windows Shell, which lets a remote unauthenticated attacker bypass Mark-of-the-Web protections. The fix shipped in the October 2026 Patch Tuesday, which addressed 1,411 flaws and three zero-days.

• CVE-2026-96951 bypasses Mark of the Web via Windows Shell
• Microsoft confirmed active exploitation; delivery vector undisclosed
• October Patch Tuesday fixed 1,411 flaws and three zero-days
• Rated High severity; exploitation requires user interaction