CVE-2026-96951

Name of the Vulnerable Software and Affected Versions Microsoft Windows Shell versions prior to October 13, 2026 updates Windows 11 23H2 versions prior to 22631.7652 Windows 11 24H2 versions prior to 26100.9711 Windows 11 25H2 versions prior to 26200.9711 Windows 11 26H2 versions prior to 26300.9711 Windows Server 2012 R2 through 2025 Windows 10 (affected versions not specified)

Description Improper neutralization of special elements used in a command (command injection) in Windows Shell allows an unauthorized attacker to bypass a security feature over a network. Specifically, this flaw allows attackers to bypass Mark of the Web (MotW), a protection mechanism that helps Windows recognize potentially unsafe downloaded content. This bypass can undermine security controls such as SmartScreen warnings and Office Protected View. Exploitation requires user interaction, as attackers deliver malicious content through email, messaging applications, or web downloads. Active exploitation of this issue has been confirmed in the wild.

Recommendations Deploy Microsoft October 13, 2026, security updates immediately for all affected versions. Update Windows 11 23H2 to build 22631.7652. Update Windows 11 24H2 to build 26100.9711. Update Windows 11 25H2 to build 26200.9711. Update Windows 11 26H2 to build 26300.9711. Apply the appropriate October 2026 security updates to all affected Windows Server installations.