Mark of the Web: The Warning Label October's Zero-Day Peeled Off
Microsoft's October 2026 Patch Tuesday, released October 13, was the biggest on record: 1,413 vulnerabilities in one month, more than Microsoft's previous full-year record of 1,261, set in 2020, per CyberScoop. Numbers that size are weather. One item in the pile is incoming fire.
That item is CVE-2026-96951, a Windows Shell flaw rated CVSS 8.8 and already being exploited. CISA added it to its Known Exploited Vulnerabilities catalog on October 13 and gave federal agencies until October 16 to patch. CISA describes it as a command injection in Windows Shell "that allows an unauthorized attacker to bypass a security feature over a network."
The security feature is Mark of the Web. If you run Windows, it's worth knowing what that is.
What Mark of the Web does
When a browser or mail client saves a file from the internet, Windows attaches a small hidden tag to it. That's Mark of the Web (MotW). The tag tells everything downstream: this came from outside, be careful.
A lot of protection depends on that tag:
- SmartScreen checks tagged programs before they run and warns on unknown or known-bad ones.
- Microsoft Office blocks macros in files from the internet, and it decides what counts as "from the internet" by the tag.
- Office opens tagged documents in Protected View, a read-only sandbox.
Take the tag off and the file looks local and trusted. The warnings never show up. That's why MotW bypasses keep appearing in real attacks: they don't break in, they get rid of the label that would have stopped you.
According to Malwarebytes, exploiting this one requires user interaction: someone has to open a crafted file or click a link that came by email or message. Tenable's Satnam Narang told CyberScoop it's the third Windows Shell vulnerability exploited this year.
The checklist
1. Patch. That's the fix. On a single PC: Settings → Windows Update → Check for updates, install, restart, then check again until it says you're up to date. If you manage a fleet, confirm the October cumulative update actually installed on each machine. "Deployed" doesn't mean installed.
2. See the tag for yourself. MotW is stored as an alternate data stream named Zone.Identifier. In PowerShell, on something you downloaded:
Get-Content .\SomeDownload.pdf -Stream Zone.Identifier
If you see ZoneId=3, the file is marked as coming from the internet. If you get an error saying the stream doesn't exist, it has no mark. Once you've seen this, you'll understand every MotW headline.
3. Stop un-blocking files by reflex. The file Properties → Unblock checkbox and the Unblock-File cmdlet both remove the tag on purpose. Sometimes that's legitimate. If it's a habit, though, you're doing the attacker's work for free. Only un-block files you got from a source you can name.
4. Keep SmartScreen and Office's macro blocking on. Both are on by default, and both fail open when the tag is missing. Don't turn them off to save a click.
5. For admins: add layers that don't depend on the tag. Microsoft Defender's Attack Surface Reduction rules block risky behavior like Office apps spawning child processes, whether or not a file is tagged. Run them in audit mode first, read the results, then enforce.
Also in the October release
Two more flaws were publicly disclosed before patches shipped, though neither is reported as exploited: CVE-2026-108398, a .NET Framework flaw that can bypass Windows Defender Application Control, and CVE-2026-92707, a memory-exhaustion bug in the MessagePack-CSharp library (Malwarebytes). If you run WDAC as a control, or ship .NET services that parse MessagePack, put these on your list.
A record month makes a lot of noise. Run it through the three questions. Is it targeted? It's exploited in the wild, so yes. Is it relevant? If you run Windows, yes. Is it actionable? There's a patch. That's three yeses. It goes to the top of the queue.
Patch it. Learn what the tag looks like. Stop peeling it off yourself.
Sources: MSRC advisory · NVD · CISA KEV catalog · CyberScoop · Malwarebytes