Microsoft’s October Patch Tuesday update fixed CVE-2026-96951, a Windows Shell flaw that attackers were already exploiting. It lets a crafted file slip past Mark of the Web protections, so Windows does not warn the user or open the file in Protected View. If your Windows machines have not installed and restarted for the October updates, they may still be exposed.
What happened
Microsoft released its October 2026 security updates on October 13. CSO Online reported a record-sized release of roughly 1,400 CVEs (its body text says 1,407; an analyst it cites says 1,413), including three zero-days. Of those three, CVE-2026-96951 is the only one reported as exploited in the wild. The other two are a SharePoint token-validation flaw (CVE-2026-102866) and a .NET Framework search-path flaw that can bypass Windows Defender Application Control (CVE-2026-108398).
Help Net Security describes CVE-2026-96951 as a command injection bug in Windows Shell. An attacker has to get a victim to open a specially crafted file, delivered by email, a chat or collaboration tool, or a malicious website download. Normally, files from the internet carry a Mark of the Web tag that triggers warnings and blocks; this flaw lets the file avoid them.
Tenable’s Satnam Narang, quoted by both outlets, says it is the third Windows Shell flaw exploited in the wild this year. The earlier two are CVE-2026-21510, linked to the APT28 group, and CVE-2026-32202, a fix for an incomplete patch of the first. He said it is unclear whether this new flaw is another incomplete fix or tied to APT28.
Why it matters
Mark of the Web is a first line of defense against malicious attachments and downloads. When it is bypassed, a user who has been trained to trust the warning prompt gets no prompt at all. Because the lure can arrive through ordinary channels like email and Teams or Slack messages, any Windows user who opens files is a potential target. A secondary report from shattered.io says hotpatch-enrolled devices still need a restart to finish the October baseline, so a machine that shows the update as installed but has not rebooted could remain vulnerable.
What to do
- Install the October 13 Windows security updates on every supported Windows 10, Windows 11 and Windows Server system, and confirm the restart has actually happened.
- Prioritize machines where staff open email attachments, chat files and browser downloads all day.
- Do not treat a missing download warning as proof a file is safe (our analysis).
- Where you have it, rely on controls that do not depend on Mark of the Web, such as behavior-based endpoint detection and application allowlisting, and review file-open and process-launch logs since October 13 for unusual child processes (our analysis).
What we still do not know
No source we reviewed names the attacker, the malware delivered, or the number of victims. The sources we reviewed do not say whether this flaw is linked to the earlier APT28 activity. We did not confirm patch package numbers for each Windows edition against Microsoft’s own advisory, so check the Microsoft Security Update Guide for your exact version.
Sources: Help Net Security, Oct. 14, 2026; CSO Online, Oct. 13, 2026; shattered.io, Oct. 24, 2026.
Leave a Reply