Windows Just Let Booby-Trapped Files Skip the Download Warning
Mark of the Web is the little Zone.Identifier tag that makes SmartScreen ask “are you sure?” before your intern runs invoice.pdf.exe. CVE-2026-96951 lets a crafted file skip that warning. Microsoft marked it Exploitation Detected. CISA put it on KEV the same day. Patch Tuesday is not a suggestion this month.
On October 13, 2026, Microsoft shipped the October cumulative updates fixing CVE-2026-96951, a Windows Shell command injection (CWE-77) that bypasses a security feature over the network. CVSS 8.8. User interaction required: someone still has to open the file or click the link. The difference is they may not get the warning that used to save them.
What happened
Mark of the Web (MOTW) is how Windows remembers a file came from the browser or email. It drives SmartScreen prompts and Office Protected View. Strip or evade that tag and a download behaves like something you created locally. Attackers love this class of bug because phishing stops being “user ignored the warning” and becomes “there was no warning.”
Microsoft’s public description is thin on the injection mechanics. No public proof of concept is referenced. HOL’s operator read and the KEV entry are enough to act: Exploitation Detected, federal due date October 16, 2026. Every supported Windows 10, Windows 11, and Windows Server build from 2012 R2 through 2025 is listed.
One detail that should make mail admins twitch: Microsoft also lists Outlook.com as fixed on the service side in release 20260925.100. The crafted file travels well through webmail. Expect attachments, not drive-by pages, as the common path.
Who is screwed
Desktops and laptops where people read email. Jump hosts. Shared admin workstations. Browser-use agents that download and open files on Windows. Servers are in scope on paper, but the attack needs a human (or an agent pretending to be one) to open something. Patch endpoints first, servers on the normal October train unless they are interactive jump boxes.
Not in scope: macOS, Linux, iOS, Android. Outlook.com mailboxes (service-side fix). Machines already on the fixed builds below.
The fix (install these)
- Windows 11 24H2 / 25H2 / 26H2: KB5127648 (builds 26100.9711, 26200.9711, 26300.9711)
- Windows 11 26H1: KB5127646 (28000.3231)
- Windows 11 23H2: KB5126653 (22631.7652)
- Windows 10 21H2 / 22H2: KB5126657 (19044.7807)
- Windows Server 2025: KB5126646; Server 2022: KB5126655; Server 2019: KB5126651; Server 2016: KB5126868; Server 2012 R2: KB5126836
No workaround. The update is the fix. Approve it in Intune / WSUS / ConfigMgr and make the restart actually happen. “Pending reboot” is how you fail a KEV audit while telling yourself you patched.
Operator checks
Confirm the build in PowerShell:
$v = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
"$($v.CurrentBuild).$($v.UBR)"Windows 11 24H2 should read 26100.9711 or higher. Lower means you are still exposed, even if Windows Update smiles at you.
To see MOTW on a download (on a patched box this still works as a teaching tool):
Get-Content -Path .\Downloads\example.zip -Stream Zone.IdentifierZoneId=3 means internet origin. On an unpatched machine, that tag’s presence does not guarantee a warning when the file opens. That is the whole problem.
Sloth take
We spent a decade training users to respect the SmartScreen prompt, then shipped a Shell bug that deletes the prompt. Phishing writers are updating templates while your change advisory board debates whether October updates are “disruptive.” Disruptive is when finance opens a zip and your EDR lights up like a Christmas tree. Install the KB. Restart the laptop. Go home.
Need a grown-up to look at your edge stack? Book a slot with Dark Edge Consulting. We do the boring, careful work so you can go back to ignoring your inbox.
Sources
- CISA KEV entry CVE-2026-96951 (added 2026-10-13, due 2026-10-16): known_exploited_vulnerabilities.json
- HOL operator read, CVE-2026-96951 MOTW bypass: hol.org
- Microsoft Security Response Center: CVE-2026-96951
- BleepingComputer, Windows 11 October 2026 cumulative updates: bleepingcomputer.com
