Microsoft patches a Windows zero-day already under attack
CVE-2026-96951 lets a crafted file skip the Mark of the Web warning entirely, and Microsoft confirmed exploitation before the fix even shipped.
Microsoft’s October Patch Tuesday fixed CVE-2026-96951, a Windows Shell bug that was already being exploited when the update shipped on 13 October. Microsoft rates it “Important” with a CVSS score of 8.8, but flagged exploitation as detected at the time of release, not just theoretical.
The flaw is a command injection in Windows Shell that lets a specially crafted file skip Mark of the Web, the flag Windows attaches to anything downloaded from the internet. Once that flag is gone, everything keyed to it goes quiet too: SmartScreen reputation checks, Office Protected View, macro blocking. A file sent over email or chat opens as though it had always been local. It still needs someone to open the file, there is no zero-click path here. The bug shipped alongside a record 1,413 CVE fixes this month, and CISA added it to its Known Exploited Vulnerabilities catalog with a remediation deadline of 16 October, today, for federal agencies.
Why it matters: Mark of the Web is the one signal a lot of other Windows defences assume is trustworthy. A bypass that quiet is worth patching ahead of the rest of this month’s pile, especially on any machine that opens files from outside the organisation.
The caveat: “Important” is Microsoft’s impact rating, not a measure of how urgently to act. Exploitation already confirmed should outweigh the severity label when deciding what to patch first.