CVE-2026-96951 – Windows Shell Security Feature Bypass Vulnerability

CVE-2026-96951 is an actively exploited Windows Shell security feature bypass vulnerability that allows attackers to evade Microsoft’s Mark of the Web (MOTW) protection. This security feature normally helps Windows identify potentially unsafe files downloaded from the internet. By exploiting a command injection weakness, attackers can bypass these protections using specially crafted files delivered through phishing emails, instant messages, or malicious websites. Although successful exploitation requires user interaction, attackers do not need existing privileges on the targeted system. Microsoft has confirmed exploitation in the wild, making this vulnerability a significant concern for organizations running affected Windows environments.

CVSS SCORE: 8.8.

SEVERITY: Important.

Threat

This vulnerability presents a serious security threat because it allows attackers to bypass an important Windows security defense designed to protect users from potentially dangerous files.

Attackers can exploit this weakness remotely by convincing users to open specially crafted files or interact with malicious content.

The attack has low complexity and does not require authentication or existing privileges.

Successful exploitation could weaken Windows security protections and increase the risk of malicious content reaching users without the expected security warnings.

The vulnerability carries a high potential impact on confidentiality, integrity, and availability.

Exploits

Microsoft has confirmed that CVE-2026-96951 is actively exploited in the wild, making it an important security concern.

The vulnerability has the following exploitation characteristics:

• Exploited in the Wild: Yes. Active exploitation has been detected.
• Publicly Disclosed: No.
• Exploit Code Maturity: Functional, indicating that functional exploit code exists.
• Attack Complexity: Low, making exploitation relatively straightforward when the required conditions are met.
• Privileges Required: None.
• User Interaction: Required.

Attackers can deliver specially crafted malicious files through phishing emails, instant messages, or links to attacker-controlled websites.

Although attackers cannot force users to interact with malicious content, convincing a user to open a file or click a malicious link may be sufficient to trigger the vulnerability.

Technical Summary

CVE-2026-96951 is caused by improper neutralization of special elements used in a command, classified as CWE-77: Command Injection, within Windows Shell.

The vulnerability allows an unauthorized attacker to bypass a Windows security feature over a network.

The primary security mechanism affected is Mark of the Web (MOTW).

MOTW is a Windows security mechanism that helps identify files originating from potentially untrusted sources, such as internet downloads and email attachments.

Windows and supported applications use this information to apply additional security checks and warnings before potentially unsafe content is opened.

By exploiting this vulnerability, attackers can evade MOTW defenses, potentially preventing the expected security protections from being applied to malicious files.

A typical attack scenario involves an attacker preparing a specially crafted file and distributing it through phishing emails, instant messages, or malicious websites.

The attacker must convince the victim to interact with the malicious content.

Once the vulnerability is successfully exploited, the attacker can bypass the affected security feature, increasing the likelihood that malicious content will be processed without the expected safeguards.

The vulnerability has a CVSS v3.1 base score of 8.8 and a temporal score of 8.2.

Its CVSS characteristics include network-based exploitation, low attack complexity, no required privileges, and required user interaction.

The vulnerability is also associated with high potential impacts on confidentiality, integrity, and availability.

Exploitability

The vulnerability affects multiple Microsoft products and operating system versions, including:

• Windows 10: Versions 1607, 1809, 21H2, and 22H2.
• Windows 11: Versions 23H2, 24H2, 25H2, and 26H1.
• Windows Server: 2012 R2, 2016, 2019, 2022, and 2025, including applicable Server Core installations.
• Microsoft Visual Studio 2026: Version 18.10.
• Outlook.com: Listed as an affected product.

Affected Windows architectures include applicable 32-bit, x64, and ARM64 systems.

Attackers can exploit this vulnerability remotely by delivering specially crafted files and convincing users to interact with them.

No privileges are required, but user interaction is necessary.

Business Impact

CVE-2026-96951 poses a significant business risk because it undermines a Windows security mechanism designed to protect employees from potentially malicious files.

Organizations frequently rely on email attachments, downloaded documents, and shared files for daily operations. Attackers can abuse these common activities to distribute malicious content.

The potential business consequences include:

• Increased Malware Exposure: Bypassing MOTW protections may make it easier for malicious files to evade expected security warnings.
• Higher Phishing Risk: Attackers can use convincing emails and malicious attachments to target employees.
• Potential Data Exposure: Successful attacks involving malicious content could increase the risk of sensitive business information being compromised.
• Operational Disruption: Malicious activity following a successful security bypass could affect business systems and employee productivity.
• Security Control Weakening: Organizations relying on Windows security warnings may lose an important layer of protection against untrusted files.

The vulnerability is particularly concerning because exploitation has already been detected.

“When attackers can bypass the security checks employees depend on, one malicious file can become the starting point for a much bigger incident.”

Workaround

Microsoft has not identified any official mitigations or workarounds for this vulnerability.

If immediate patching is not possible, organizations can consider general risk-reduction measures:

• Strengthen email filtering to reduce malicious attachments.
• Block suspicious file downloads where possible.
• Remind employees not to open unexpected attachments or suspicious links.
• Monitor endpoint security alerts for unusual activity.
• Prioritize affected systems for patch deployment.

These measures do not eliminate the vulnerability.

Applying the official Microsoft security updates remains the recommended remediation.

Urgency

Immediate patch deployment is strongly recommended because CVE-2026-96951 is actively exploited in the wild and functional exploit code exists.

Although Microsoft classifies this vulnerability as Important rather than Critical, its CVSS score of 8.8 reflects a high level of technical risk.

The combination of active exploitation, low attack complexity, and no required privileges makes this vulnerability particularly concerning.

Attackers can target users through common communication channels, including phishing emails and instant messages, increasing the opportunities for exploitation.

Organizations should prioritize deployment of the applicable Microsoft security updates across affected Windows workstations, servers, and other listed products.

All listed affected products require a restart following the applicable update, and no known update issues are identified.

Patch deployment should prioritize systems with greater exposure to untrusted files and external communications.

“This is not just a security weakness waiting to be discovered. Attackers are already exploiting it, making delayed patching an unnecessary business risk.”