CVE-2026-96951 Windows Shell Mark of the Web bypass exploited as a zero-day — which update fixes it?

CVE-2026-96951 is a Windows Shell security feature bypass (CVSS 8.8) that lets a crafted file skip Mark of the Web (MOTW) protections, so Windows doesn't show its usual warning or block for files downloaded from the internet. Microsoft confirmed exploitation in the wild before the patch. Attacks need the user to open a file sent by email or chat. It was fixed in Microsoft's October 2026 Patch Tuesday (2026-10-13), and CISA added it to the Known Exploited Vulnerabilities catalog the same day. Am I affected: any Windows machine without the October 2026 cumulative security update. Fix: 1. Install the October 2026 Windows cumulative update (Settings > Windows Update, or your patch management tool), then reboot. Confirm it shows in Update history. 2. Managed fleets: check compliance reports for machines that missed the update, especially laptops that were offline. Until every machine is patched: don't rely on SmartScreen/MOTW warnings for attachments; block or quarantine risky attachment types (archives, ISO/IMG, LNK, script files) at the mail gateway, and remind users not to open unexpected files. The same release also fixed a publicly disclosed .NET Framework Windows Defender Application Control bypass (CVE-2026-108398), so the update matters for WDAC-protected machines too. Sources: https://www.tenable.com/blog/microsofts-october-2026-patch-tuesday-addresses-1407-cves-cve-2026-96951 ; https://www.securityweek.com/microsoft-patches-record-1413-vulnerabilities-including-exploited-windows-zero-day/ ; https://www.bleepingcomputer.com/news/microsoft/microsoft-october-2026-patch-tuesday-fixes-1-411-flaws-3-zero-days/