With its October updates Microsoft fixed CVE-2026-96951, a flaw in Windows Shell that attackers are already exploiting. A specially crafted file sent by email, chat or a web page bypasses the Mark of the Web label, so no SmartScreen warning appears and Office does not open it in Protected View. Windows 10, Windows 11 and Windows Server are affected. CISA added it to its Known Exploited Vulnerabilities catalogue on 13 October.
What it means: Mark of the Web is one of the quiet mechanisms that protect Windows users every day: each file that arrives from the internet gets a label, and based on it Windows and Office show warnings or open the file in a restricted mode. When the label is bypassed, the user loses the last message that would have made them stop before opening something dangerous. That is why such flaws often appear in phishing campaigns against businesses, where a fake invoice or a supposed offer is enough to start an attack. It is the third actively exploited Windows Shell flaw this year, which shows that attackers keep coming back to this spot. For Greek offices and accounting firms, which exchange attachments with clients and suppliers every day, installing the October updates promptly is the main defence. The support cycle also matters: the Home and Pro editions of Windows 11 24H2 stopped receiving updates on 13 October, so anyone still on that version needs to upgrade to keep getting fixes. Finally, the lack of a warning does not mean a file is safe; an unexpected attachment stays suspicious until the sender is confirmed another way.
Read the original on Microsoft
Related service: Custom software