Microsoft fixes exploited Mark of the Web bypass security flaw

What happened

In another record-breaking Patch Tuesday, Microsoft has squashed over 1,400 security bugs, including a Mark of the Web bypass vulnerability (CVE-2026-96951 (the public catalogue number for a specific software flaw)) exploited by attackers in the wild. Alternatively, users … More → The post Microsoft fixes exploited Mark of the Web bypass vulnerability (CVE-2026-96951) appeared first on Help Net Security . Microsoft is a software and software development company based in Redmond, and its products and services include Microsoft Windows.

CVE-2026-96951 is a command injection vulnerability in Windows Shell that can be triggered by remote attackers via a file that is designed to exploit the vulnerability. Such a file can be sent to the user via email, instant message, or collaboration tools like Teams and Slack.