Microsoft patches actively exploited Windows Shell zero day vulnerability

Microsoft has released a patch for an actively exploited zero-day vulnerability in the Windows Shell, tracked as CVE-2026-96951. SOC Prime, Help Net Security, and SecurityWeek all report that the security feature bypass flaw is being used in real-world attacks. SOC Prime notes that the vulnerability has a CVSS score of 8.8, while Help Net Security identifies it as a command injection issue. [1][2][6]

The flaw allows an unauthenticated remote attacker to evade Mark of the Web security protections. According to SOC Prime and Help Net Security, attackers can trigger the exploit by convincing a user to open or interact with a specially crafted file. [1][2]

The fix was released as part of Microsoft's October 2026 Patch Tuesday updates. Help Net Security, Cyber Press, SecurityWeek, and BigGo Finance report that the release resolved 1,413 total security vulnerabilities. As FTMQ Security reported earlier, the updates cover Windows 10, Windows 11, and Windows Server, alongside Office, SharePoint Server, and SQL Server products. [1][2][5][6][8][12]

Security administrators must apply the security updates immediately to protect systems against active exploitation. [1][2]