Windows Shell Zero-Day Bypasses Mark of the Web, Already Exploited

Microsoft's October Patch Tuesday included a fix for a Windows Shell vulnerability that attackers were already exploiting. The flaw lets them sidestep Mark of the Web, the feature that flags files downloaded from the internet and warns you before you open them. Windows 10, Windows 11, Windows Server from 2012 R2 onward and Outlook.com are all affected. If you haven't installed October's updates yet, now is the time.

The vulnerability at a glance

The bug is tracked as CVE-2026-96951 (EUVD-2026-100274) and carries a CVSS score of 8.8. Microsoft rates it "Important" and has confirmed active exploitation. CISA added it to its Known Exploited Vulnerabilities catalog on Patch Tuesday itself, October 13, 2026.

Under the hood, it is a command injection issue. The Windows Shell, the part of Windows you use to open and manage files, fails to properly neutralize special characters in a command. Attackers abuse this to bypass Mark of the Web (MotW). Normally, Windows tags downloaded files so it can show a security prompt or open Office documents in Protected View. A successful attack removes that safety net.

How an attack plays out

You still have to take the bait. According to Microsoft, attackers need you to click a link to a site they control or open a malicious attachment. From there, the attack is low in complexity, works over the network and needs no credentials. It is standard phishing, minus the warning that might otherwise have made you pause. Microsoft has not published workarounds or indicators of compromise.

Updates that fix it

Run winver to see which build you are on. Beyond patching, the best defense is awareness: make sure you and your team stay wary of attachments and links from unknown senders. With this bug, the usual warning simply won't show up, so your own skepticism has to do the job.