Windows: do not open the unexpected file
CVE-2026-96951 bypasses Mark of the Web after user action. NVD has changed: its Outlook Web entry no longer has a version bound.
Getting started
Generated image · SecuFocus
At a glance
Key points
If you use Windows, do not open an unexpected file from email or a message. Install the October update. The federal due date written on the entry is 16 October 2026.
What changes
On 14 October 2026, the JSON feed of the known exploited vulnerabilities catalog was version 2026.10.13, with 1,741 entries, released on 13 October 2026 at 19:10 UTC. Two entries were added on 13 October. One is Ivanti Connect Secure, already noted. The other is CVE-2026-96951, Microsoft Windows. The catalog title calls it a command injection. The description says Windows Shell lets an unauthorized attacker bypass a security feature over a network. The due date written on the entry is 16 October 2026. The ransomware field says Unknown. Forensic triage says Yes. The named weakness is CWE-77. On 15 October 2026, the feed is version 2026.10.14, with 1,745 entries. CVE-2026-96951 has not changed its due date: 16 October is still written on the entry. The four additions of 14 October have their own note.
The CISA alert from the same day says both flaws were added based on evidence of active exploitation. It does not describe the file, or a Windows version.
On 16 October 2026, the feed is version 2026.10.15, with 1,746 entries, released on 15 October 2026 at 17:00 UTC. CVE-2026-96951 did not change due date. The 15 October addition is Atlassian, already noted. The Windows action does not change. On 17 October 2026, the feed is version 2026.10.16, with 1,748 entries, released on 16 October 2026 at 17:15 UTC. Two entries were added on 16 October: CVE-2026-102764, BeyondTrust, and CVE-2025-61624, Fortinet. They have their own note. CVE-2026-96951 did not change due date: 16 October is still written on it. The Windows action does not change.
What Microsoft says about the move
The Microsoft guide, reread on 19 October 2026 through its API, titles the flaw Windows Shell Security Feature Bypass. The listed severity is Important. The listed impact is a security feature bypass. The base score is 8.8. The temporal score is 8.2. The exploited field says Yes. The publiclyDisclosed field says No. These details come from Microsoft’s API, not from a test on a Windows machine.
The FAQ in the same guide says an attacker who succeeds could evade Mark of the Web defenses. It describes an email or instant-message scenario: a file prepared for the flaw. It also says the attacker cannot force the person to open it. The person has to click a link or open the attachment.
The NVD record, reread through the API on 19 October 2026, is now Analyzed and was last modified on 16 October at 17:18 UTC. Its English description still covers a security feature bypass in Windows Shell. Microsoft supplies a CVSS 3.1 score of 8.8, high: network access, low complexity, no account, user action required. The CISA coordinator marks exploitation as active, not automatable, with total technical impact.
The CPE configurations name Windows 10, Windows 11 and several Windows Server versions, with build bounds for each system. They also name Outlook Web, under the identifier outlook_web, without a version range. The 20260925.100 bound quoted in our earlier reading of Outlook.com is no longer in that configuration and is no longer presented here as a current bound. This entry does not establish an update that an Outlook Web user should install.
What we did not check
We did not install the update, and we did not open a crafted file. Exploited comes from the catalog, the CISA alert and the Microsoft field, not from a SecuFocus test. Unknown in the ransomware field does not prove a campaign is absent. We did not reread directive BOD 26-04. 16 October is the date written for United States federal civilian agencies. It is not a deadline SecuFocus sets for other readers. On 15 October 2026, advisory CERTFR-2026-AVI-1314, published on 14 October, says Microsoft indicates that CVE-2026-96951 is being exploited. It lists many other Windows identifiers. It does not give a version bound for this one, or a due date different from the catalog. The move does not change.
The choice
If you use Windows, do not open an unexpected file or link from email or a message. Run Windows Update and install the updates applicable to your system. Microsoft’s FAQ still requires user action for the described attack. The Outlook Web entry in NVD provides no version bound from which to choose a fixed release yourself. Ivanti Connect Secure remains a separate note for a different product.
Check and explore
Sources for this article
Numbers connect each reference to the passages that use it. Dates show when the documentation was consulted.
- CERT-FR, advisory CERTFR-2026-AVI-1314 of 14 October 2026, Microsoft Windows ↗cert.cyber.gouv.fr ·Used in:What we did not check
This article draws on the sources above. The exercises are for you to try on your devices; SecuFocus does not present them as tests carried out by its editorial team. Interfaces and features can change. Method and corrections.
Cite this article
Keep this reference with the article when you save or share it.