CISA orders a patch for an exploited Windows file-safety bypass
CVE-2026-96951 lets attackers strip the Mark of the Web flag from a downloaded file, switching off SmartScreen, Office Protected View and macro blocking at once.
CISA added CVE-2026-96951, a Windows Shell command injection vulnerability, to its Known Exploited Vulnerabilities catalogue on 13 October, alongside an Ivanti Connect Secure flaw. It gives federal civilian agencies until 16 October to patch.
Microsoft patched the bug in this month’s Patch Tuesday update and confirmed it is being actively exploited. The flaw lets an attacker evade Mark of the Web, the flag Windows attaches to files downloaded from the internet. Strip that flag and every protection keyed to it goes quiet at once: no SmartScreen reputation check, no Office Protected View, no macro blocking. Microsoft’s advisory says attackers deliver the crafted file by email or instant message and need the recipient to open it. It carries a CVSS score of 8.8.
Why it matters: Mark of the Web is one of the few checks standing between a downloaded file and code running on your machine, and a lot of other defences assume it still works. If you manage Windows build agents, CI runners or developer laptops, this is a this-week patch, not a when-you-get-to-it one.
The caveat: exploitation still needs a user to open the file. This is a phishing-delivery bug, not a remote, no-click one.