CVE-2026-96951: Windows Mark-of-the-Web bypass exploited in the wild

Microsoft's October 2026 Patch Tuesday fixed CVE-2026-96951, an 8.8-rated Windows Shell flaw that lets crafted files evade the Mark-of-the-Web, so SmartScreen, Office Protected View and run-prompt warnings may not fire. Microsoft confirmed exploitation, and CISA added it to its KEV catalog with a 16 October 2026 deadline.

• CVE-2026-96951 in Windows Shell is rated 8.8 and confirmed exploited
• The bypass disables SmartScreen, Protected View and run-prompt warnings
• CISA added it to the KEV catalog with a 16 October 2026 deadline
• The same patch fixed a WDAC bypass, CVE-2026-108398, in .NET Framework