Microsoft fixes exploited Mark of the Web bypass vulnerability (CVE-2026-96951)

In another record-breaking Patch Tuesday, Microsoft has squashed over 1,400 security bugs, including a Mark of the Web bypass vulnerability (CVE-2026-96951) exploited by attackers in the wild.

CVE-2026-96951 is a command injection vulnerability in Windows Shell that can be triggered by remote attackers via a file that is designed to exploit the vulnerability.

Such a file can be sent to the user via email, instant message, or collaboration tools like Teams and Slack. Alternatively, users can be tricked into downloading it themselves from a malicious website.

User interaction is, therefore, required, but once that hurdle is overcome, opening such a file bypasses the Mark of the Web protections that would normally:

• Warn the user about the possible danger of opening it
• Open the file in read-only “Protected View”, or
• Block it from opening.

“This is the third flaw in Windows Shell that was exploited in the wild this year,” noted Satnam Narang, senior staff research engineer, Tenable.

“The other two were CVE-2026-21510, which is linked to the advanced persistent threat group APT28 (also known as Fancy Bear), and CVE-2026-32202, which was a fix for an incomplete patch for CVE-2026-21510. The exploitation of CVE-2026-32202 has yet to be attributed, and it is unclear if CVE-2026-96951 was created to address another incomplete fix or if exploitation is linked to APT28.”

In any case, testing and implementing this patch should be prioritized, since the vulnerability is being actively leveraged by attackers.

Beyond the zero-day: SharePoint, wormable RCEs

Dustin Childs, Head of Threat Awareness of TrendAI’s Zero Day Initiative, flagged CVE-2026-102866 as important to address quickly.

It is a critical improper cryptographic signature verification bug in Microsoft Office SharePoint that allows unauthenticated attackers to hijack targeted user accounts.

“An attacker who obtains a valid proof token for a targeted user could modify it, submit it to the server, and authenticate as that user. The only caveat is that the attacker has to obtain that token first, but there are multiple methods this could be achieved,” he said.

Microsoft marked the flaw as less likely to be exploited, probably because it can only be triggered if specific conditions, such as particular protocol settings or configurations, are present.

Childs also noted that Microsoft has plugged 55 wormable flaws – unauthenticated, zero-click RCE bugs – across critical infrastructure like DHCP Server, Remote Desktop Gateway, and Network Policy Server – and advised organizations to implement those fixes in a timely manner.

He noted that AI is accelerating bug-hunting by vendors and outside researchers, researchers, but isn’t creating these bugs out of thin air – it’s just shortening the time between a vulnerability existing and someone noticing it.

“The volume isn’t the real story anymore. What matters is that discovery is scaling faster than exploitation, so teams that triage by sheer CVE count instead of exploitability are burning cycles on the wrong bugs. Patch what’s proven, prioritized, and public, and treat everything else as this month’s new normal,” he advised.

Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!