Microsoft patches actively exploited Windows Shell command injection flaw that bypasses Mark of the Web

Microsoft's October Patch Tuesday fixed more than 1,400 flaws, including CVE-2026-96951, a command injection flaw in Windows Shell that attackers are exploiting in the wild. A remote attacker can trigger it with a specially crafted file delivered by email, instant message, collaboration tools, or a malicious website, though the victim must open the file. Doing so bypasses Mark of the Web protections that would normally warn the user, open the file in read-only Protected View, or block it. Microsoft has not named affected build numbers in the advisory, and the fix ships in this month's update. Administrators should apply it promptly.

Check

Apply the October Windows updates across all systems promptly, prioritizing CVE-2026-96951, and warn users against opening unexpected files from email, chat, or websites.

Affected

Unpatched Windows systems let a crafted file bypass Mark of the Web warnings and inject commands when a user opens it, and attackers are exploiting this now.

Fix

Deploy the Patch Tuesday fixes, reinforce user caution around attachments and downloads, and monitor endpoints for suspicious file execution following Mark of the Web bypass.