CVE-2026-96951: Windows Shell Zero-Day Strips MotW from Crafted Archives, Every Windows Version Exposed
Reach 50,000+ security professionals
Sponsor a newsletter slot and put your brand in front of CISOs, engineers, and IT decision-makers.
CVE-2026-96951 (CVSS 8.8) lets an attacker strip Mark of the Web protection from files inside specially crafted archives, causing every Windows version from Server 2012 R2 through Windows 11 to execute adversary payloads without SmartScreen warnings. Microsoft confirmed active exploitation in the wild and patched the flaw on October 13, 2026. CISA ordered US federal agencies to remediate by October 16. That deadline has passed.
Mark of the Web (MotW) is Windows' foundational defense against malicious downloads. When a user downloads a file from the internet, Windows Shell attaches a Zone.Identifier alternate data stream to the file. SmartScreen reads this tag before any executable or script runs: if the file arrived from the internet zone, SmartScreen performs a reputation check and displays a warning for unknown binaries. Microsoft Office's Protected View similarly reads MotW to decide whether to open a document in sandboxed mode. CVE-2026-96951 exploits a flaw in how Windows Shell propagates MotW tags during archive extraction, specifically inside specially formatted ZIP, ISO, or IMG containers. When the victim opens a crafted archive and extracts its contents, Windows Shell fails to attach the Zone.Identifier stream to the internal files. The payload inside the archive executes as if it had been locally created, bypassing SmartScreen entirely.
The threat is immediate and broad. User interaction is required, meaning attackers deliver the crafted archive via phishing email or malicious link, then the victim opens it. No elevated privileges are needed, no authentication is required from the attacker's side, and no secondary payload chain is needed to reach a code execution primitive: the bypassed SmartScreen check is itself the gate that defenders rely on to stop malware delivery. Ransomware actors, initial access brokers, and nation-state threat actors have all used MotW bypass techniques extensively in prior campaigns. Organizations that have not applied the October 2026 cumulative update to every Windows endpoint and server are exposed right now.
How Does CVE-2026-96951 Strip Mark of the Web Protection?
CVE-2026-96951 is classified as CWE-77 (Command Injection in Windows Shell), but the practical effect is a security feature bypass: Windows Shell's archive extraction routine fails to propagate the Zone.Identifier alternate data stream to files extracted from certain crafted container formats.
Mark of the Web (MotW) is a Windows NTFS feature that stores internet zone metadata as an ADS attached to a file. When a browser or mail client downloads or saves a file from an internet source, it calls the IAttachmentExecute API to apply a Zone.Identifier tag with a ZoneId value of 3, meaning "Internet Zone." SmartScreen Application Reputation reads this tag before Windows executes any binary or script. When the tag is absent or shows ZoneId 0 (local), SmartScreen skips its reputation check and executes without warning.
The flaw in CVE-2026-96951 sits in Windows Shell's handling of archive container formats. When a user double-clicks a downloaded archive (which correctly carries MotW ZoneId=3 at the container level) and then extracts its contents, Windows Shell is supposed to inherit and re-apply the Zone.Identifier stream to every extracted file. On vulnerable builds, the inheritance fails for specific archive structures an attacker can craft. The extracted payload receives no Zone.Identifier ADS, landing on disk as a ZoneId=0 (local) file, and SmartScreen never inspects it.
The attack chain requires user interaction: the victim must download the crafted archive (the container itself has MotW and may show a brief zone warning when first opened), then extract the contents, then execute the internal payload. Each step is a normal Windows workflow that users perform thousands of times daily. An attacker embedding a malicious script in the root of a crafted archive can reliably bypass SmartScreen for any victim who opens and extracts the file, regardless of the payload signature or reputation.
Microsoft has not disclosed the specific archive format variants that trigger the flaw, and no public proof-of-concept code was available as of October 19, 2026.
Which Windows Versions Are Vulnerable Right Now?
CVE-2026-96951 affects every current Windows release, covering the full enterprise endpoint and server fleet for most organizations.
Affected products:
- Windows 10 (all builds, including ESU-enrolled devices)
- Windows 11 (all supported versions: 22H2, 23H2, 24H2)
- Windows Server 2012 R2 (ESU through 2026)
- Windows Server 2016
- Windows Server 2019
- Windows Server 2022
- Windows Server 2025
Microsoft released the fix in the October 13, 2026 monthly cumulative updates for each affected product line. There is no standalone workaround or registry mitigation that closes the vulnerability without applying the patch. There is no configuration option to force MotW propagation through the vulnerable archive handling code path, so disabling features is not an effective substitute.
Windows 10 devices not enrolled in Extended Security Updates cannot receive the patch through standard Windows Update channels and require a standalone update package from the Microsoft Update Catalog. Most managed enterprise endpoints receive the cumulative update through Windows Update for Business, WSUS, or MECM (formerly SCCM) patch deployment workflows. Verify that the update reached every endpoint, including servers, VDI golden images, jump hosts, and developer workstations that may be excluded from standard patch rings.
Organizations running Windows on AWS EC2, Azure VMs, or GCP Compute Engine instances are equally affected. Cloud virtual machines do not receive Windows updates automatically unless the standard Windows Update client is enabled or a patch management tool is configured for the instance.
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
Why Ransomware Gangs Favor MotW Bypass as Initial Access
Mark of the Web bypass techniques are among the most valued initial access primitives in modern ransomware and nation-state campaigns. The reason is reliability: SmartScreen is one of the last behavioral controls that stands between a downloaded file and automatic execution across all Windows versions.
Prior MotW bypass CVEs demonstrate the pattern. CVE-2022-44698 (Windows SmartScreen bypass) was exploited by Magniber ransomware to deliver payloads without user warnings. CVE-2023-24880 (Windows SmartScreen bypass) was used by the Qakbot malware group in large-scale phishing campaigns before Qakbot's infrastructure was disrupted. CVE-2024-21412 and CVE-2024-38213 were chained by the DarkGate loader and Water Hydra APT group to distribute commodity malware through forged internet shortcuts.
CVE-2026-96951 follows the same structural pattern. An attacker who can deliver a crafted archive to a Windows user bypasses SmartScreen for any payload inside it, regardless of the payload's file type, signature status, or known-bad reputation. This means:
- No reputation block on initial access: Even a freshly compiled, never-before-seen executable gets no SmartScreen reputation check when extracted from the crafted archive.
- Office macros are bypassed: A .xlsm or .docm file inside the crafted archive opens in Full Trust mode rather than Protected View, letting legacy macro attacks bypass the Office sandbox without requiring additional macro policy abuse.
- LNK and shortcut-based loaders run unblocked: Shortcut files (.lnk) inside the crafted archive execute their target commands without a "file downloaded from the internet" prompt.
The Qilin ransomware campaign we tracked in October 2026 used stolen VPN access as its initial foothold. CVE-2026-96951 represents a complementary initial access vector that does not require any network-level perimeter compromise: phishing alone, combined with a crafted archive, provides a reliable code execution primitive against unpatched endpoints.
“Microsoft marked CVE-2026-96951 as Exploitation Detected on release day, October 13, 2026, confirming that threat actors were already using this flaw in active attacks before the patch shipped.”
Microsoft Security Response Center, October 13, 2026
Indicators of Compromise and Behavioral Signals
No specific attacker-controlled IP addresses, domains, or file hashes have been published by Microsoft or CISA for CVE-2026-96951 as of October 19, 2026. The attack payloads vary by campaign. The following behavioral and structural indicators are derived from the known attack mechanism and post-exploitation patterns consistent with MotW bypass exploitation campaigns.
Search telemetry from your endpoint, mail gateway, and proxy logs for these signals:
Subscribe to unlock Indicators of Compromise
Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.
Sigma Detection Rules for CVE-2026-96951 Windows Shell MotW Bypass
Two detection rules cover CVE-2026-96951 exploitation: the first targets the Zone.Identifier ADS absence pattern for files extracted from downloaded archives, and the second catches script interpreter spawning from user download paths without a MotW check event. Both carry experimental status; validate against your Sysmon configuration and log format before enabling automatic blocking. WAF rules are not applicable: this is a client-side archive extraction flaw with no network-layer HTTP signature.
Subscribe to unlock Sigma Detection Rules
Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.
Subscribe to unlock Sigma Hunt Queries
Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.
Patch CVE-2026-96951: Apply October Patch Tuesday Now
The sole remediation for CVE-2026-96951 is applying the October 2026 cumulative security update. There is no registry key, Group Policy setting, or configuration change that closes the flaw without the patch. The remediation steps below apply to all affected Windows versions.
Subscribe to unlock Remediation & Mitigation steps
Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.
Why CVE-2026-96951 Matters Beyond October Patch Tuesday
The scale of October 2026 Patch Tuesday (1,411 vulnerabilities, the largest on record) risks pushing CVE-2026-96951 down security teams' priority lists behind higher-CVSS critical vulnerabilities. That would be a mistake.
MotW bypass zero-days have a disproportionate operational impact relative to their CVSS score because they disable a systemic control across the entire Windows fleet simultaneously. When CVE-2026-96951 is unpatched, every Windows endpoint in an organization becomes susceptible to malware delivery from any phishing lure that uses a crafted archive container. SmartScreen, which blocks an estimated 80 to 100 million malicious downloads per month across the Windows ecosystem, stops working for any file contained in such an archive. The 8.8 CVSS score reflects the user-interaction requirement (attacker can't trigger remotely without the victim opening a file), but in practice, social engineering to open a downloaded archive is one of the easiest initial access steps in modern campaigns.
The CISA KEV deadline of October 16 has already passed for federal agencies. Organizations that delayed patch deployment because they were working through higher-CVSS October Patch Tuesday items should reprioritize CVE-2026-96951 to the front of the queue. A 9.8 CVSS remote code execution on an internal service is dangerous, but a MotW bypass that enables a phishing email to deliver an unblocked payload to every Windows endpoint in the organization is often the higher-urgency operational risk.
Threat actors exploiting CVE-2026-96951 do not need to scan any external attack surface, exploit any network service, or bypass any perimeter control. The attack starts in the victim's inbox.
The bottom line
CVE-2026-96951 strips Mark of the Web from files inside specially crafted archives, enabling attackers to deliver undetected payloads to every Windows 10, 11, and Server version via phishing without triggering a SmartScreen alert. CISA confirmed active exploitation and set a federal deadline of October 16 that has now passed. Three actions matter now: apply the October 2026 Patch Tuesday cumulative update to every Windows system in your environment, verify patch deployment with PowerShell across endpoints WSUS or MECM may have missed, and deploy Sysmon EventID 15 monitoring to detect Zone.Identifier ADS absence on files in user download paths. Start with the patch.
This analysis is generic. create a free account to score threats like this against your own stack.
Frequently asked questions
What is CVE-2026-96951?
CVE-2026-96951 is a CVSS 8.8 Windows Shell security feature bypass that lets attackers strip the Mark of the Web (MotW) Zone.Identifier alternate data stream from files inside specially crafted archive formats such as ZIP, ISO, and IMG containers. When Windows Shell processes a crafted archive, it fails to propagate the MotW tag to extracted files, so SmartScreen and Microsoft Office Protected View treat the payload as locally trusted content. The flaw is actively exploited in the wild and was patched in Microsoft's October 13, 2026 cumulative update.
What is Mark of the Web and why does it bypass SmartScreen matter?
Mark of the Web (MotW) is a Windows security mechanism that attaches a Zone.Identifier alternate data stream to files downloaded from the internet or received as email attachments. SmartScreen reads this tag before executing a file: if the tag indicates Zone 3 (internet zone), SmartScreen performs a reputation check and displays a warning if the file is unknown or malicious. When CVE-2026-96951 strips the MotW tag from an adversary payload inside a crafted archive, SmartScreen never sees the internet origin, treats the file as locally created, and lets it execute silently. Office Protected View, which normally opens downloaded documents in a sandboxed read-only mode, is similarly bypassed.
Which Windows versions are affected by CVE-2026-96951?
CVE-2026-96951 affects Windows 10 (all builds under Extended Security Updates), Windows 11 (all supported versions), Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. Microsoft has not released a standalone workaround: applying the October 13, 2026 cumulative security update is the only fix. Windows 10 devices not enrolled in Microsoft's Extended Security Updates program do not receive this patch through Windows Update and require a separate standalone package.
Is CVE-2026-96951 being actively exploited in attacks?
Yes. Microsoft marked CVE-2026-96951 as Exploitation Detected on October 13, 2026, meaning Microsoft has confirmed at least one successful attack in the wild before the patch shipped. CISA added it to its Known Exploited Vulnerabilities catalog on the same day with a federal agency remediation deadline of October 16, 2026. No public proof-of-concept code has been released, but the active exploitation status and CISA KEV listing indicate threat actors are using it operationally against real targets.
How do attackers exploit the Windows Shell MotW bypass?
An attacker crafts a specially formatted archive (such as a ZIP or ISO file) where the internal file structure causes Windows Shell to omit the Zone.Identifier alternate data stream when extracting contents. The attacker delivers this archive via a phishing email, a drive-by download, or a malicious link. When the victim downloads and opens the archive in Windows Explorer or a similar shell handler, the extracted payload carries no MotW tag. When the victim double-clicks the payload, SmartScreen skips its reputation check and the payload executes without any security warning. User interaction is required but the attack requires no elevated privileges or prior system access.
How do I patch CVE-2026-96951?
Apply the October 2026 cumulative security update for your Windows build. For Windows 11 systems, install KB5127648 or later. For Windows 10, install the October 2026 cumulative update via Windows Update or the Microsoft Update Catalog. For Windows Server, apply the equivalent monthly rollup for your version. After patching, Windows Shell will correctly propagate Zone.Identifier tags to files extracted from all affected archive formats. Verify the patch is applied by running winver and confirming the build number matches Microsoft's October 2026 release, then check Windows Update history for October 13, 2026 updates.
What is the CISA deadline for patching CVE-2026-96951?
CISA added CVE-2026-96951 to the Known Exploited Vulnerabilities catalog on October 13, 2026 and set a federal civilian executive branch remediation deadline of October 16, 2026, a 72-hour window. That deadline has passed for US federal agencies. Non-federal organizations are not legally bound by the BOD 26-04 deadline but CISA strongly recommends all organizations prioritize KEV entries. With the federal deadline expired, organizations still running unpatched Windows are exposed in a threat environment where attackers are actively using this vulnerability.
Can EDR or antivirus detect CVE-2026-96951 exploitation?
Detection is possible but requires behavioral rules rather than signature matching against the archived file. An EDR can detect the behavioral chain that follows a successful MotW bypass: a script interpreter (PowerShell, wscript.exe, mshta.exe) launched from a path in the user's Downloads or Temp directory without a corresponding SmartScreen prompt event. Sysmon rule 11 (FileCreate) can detect absence of Zone.Identifier alternate data streams on new files in monitored directories. The Sigma and EDR queries in this post cover these detection angles. Signature-based detection of the crafted archive itself may be inconsistent since the payload inside the archive is attacker-controlled and will vary per campaign.
Sources & references
- Microsoft Security Response Center: CVE-2026-96951 Windows Shell Security Feature Bypass Vulnerability
- CISA Known Exploited Vulnerabilities Catalog: Microsoft Windows Shell Mark of the Web Bypass (CVE-2026-96951)
- BleepingComputer: Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days
- SOCRadar: October 2026 Patch Tuesday Analysis
- WindowsForum: October 2026 Patch Tuesday 1,400 Fixes, Exploited Windows Shell Zero-Day
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Daily briefings + Google Top Stories in one step.
Enter your email and we'll subscribe you to the daily briefing and add Decryption Digest to your Google Search feed at the same time.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.