Microsoft Patches Actively Exploited Windows Shell Zero-Day (CVE-2026-96951) Bypassing Mark of the Web

Microsoft has released an urgent patch for CVE-2026-96951, a high-severity Windows Shell security feature bypass vulnerability that is actively being exploited in real-world attacks. The flaw, which carries a CVSS score of 8.8, allows attackers to evade Mark of the Web (MOTW) protections. CISA has added this zero-day to its Known Exploited Vulnerabilities catalog, mandating federal agencies to apply the fix by October 16, 2026.