CVE-2026-96951: Windows Shell MOTW bypass exploited, patch by 16 Oct
October Patch Tuesday zero-day bypasses Mark of the Web on Windows 10, 11, and Server

CVE-2026-96951: Windows Shell MOTW bypass exploited, patch by 16 Oct

Microsoft's October 2026 Patch Tuesday is a record: 1,413 CVEs, including one already exploited. That bug is CVE-2026-96951, a Windows Shell security-feature bypass rated CVSS 8.8. CISA added it to the Known Exploited Vulnerabilities catalog on 13 October and set a federal remediation date of 16 October 2026.

What happened

Microsoft says a successful exploit lets an attacker evade Mark of the Web defenses. MOTW is the tag Windows puts on files that arrived from the internet, and it is what triggers the usual "this file might be unsafe" warning and Protected View style checks. A crafted file sent by email or instant message, or a link the user is talked into opening, can skip that check.

Microsoft credited Fujitsu researchers Riku Bamba and Yuya Chudo, Anthropic's Benoit Sevens, and a researcher named yhw. It has not said who is exploiting the bug or which organizations were hit. The Hacker News and Rapid7 both describe it as a command-injection style bypass in Windows Shell, not a silent worm. User action is still required. The problem is that the action no longer gets the warning users are trained to notice.

Two other flaws were public before the patch. CVE-2026-108398 (CVSS 8.8) is a .NET Framework untrusted-search-path bug that can bypass App Control for Business / WDAC if an attacker already has a local foothold. CVE-2026-92707 is a lower-severity denial-of-service issue in MessagePack-CSharp. Neither is the exploited item.

Who is affected

Ivanti's Patch Tuesday note and Dark Reading both say CVE-2026-96951 hits Windows 10, Windows 11, and Windows Server from 2012 R2 through 2025. The rest of the release is broad: The Hacker News counts 1,102 Windows flaws, 134 in Office, 61 in Developer Tools, 36 in SharePoint Server, and 22 in SQL Server, with more than 70 rated Critical.

What to do now

Deploy the October cumulative update to Windows 10, Windows 11, and Windows Server before 16 October, and do not wait on the rest of the 1,413-item list. Prioritize internet-facing and user workstations first, then servers that open mail or browse. After patching, keep the usual email controls: block or detonate unexpected attachments, and do not treat a missing MOTW prompt as a safe file.

If you use App Control for Business, schedule CVE-2026-108398 in the same change window. It needs a foothold, but it is exactly the kind of bypass an attacker uses after the first shell. Office fleets should also take the Outlook reading-pane fixes. Rapid7 says previewing a message can be enough on those five bugs, and they are not listed as exploited.

Source: The Hacker News, Microsoft Patches Record 1,413 Flaws. CISA's KEV addition is at cisa.gov.

Also on the blog

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.

CVE-2026-104935: Ivanti Connect Secure auth bypass exploited since Oct 3
Unauthenticated command execution on ICS VPN, privilege escalation still unpatched