■■■■□ Microsoft has patched an actively exploited Windows Shell zero-day vulnerability that allows attackers to bypass Mark of the Web protections. Tracked as CVE-2026-96951, the flaw was addressed in the October 2026 Patch Tuesday updates. It carries a CVSS score of 8.8 and is rated Important by Microsoft.
The vulnerability was not publicly disclosed before the update, but Microsoft confirmed that exploitation had already occurred. Its “Exploitation Detected” assessment signals a confirmed attack rather than a possible future threat. Microsoft’s Exploitability Index advises customers to give applicable updates in this category the highest priority.
Microsoft Windows Shell 0-Day Vulnerability Actively Exploited in Attacks