Microsoft fixes exploited Mark of the Web bypass vulnerability (CVE-2026-96951)

Microsoft's latest Patch Tuesday round closed more than 1,400 vulnerabilities, setting a new record, and among them is CVE-2026-96951, a Windows Shell command injection flaw already being abused by attackers. Exploiting it requires getting a victim to open a specially crafted file—delivered through email, chat apps, or a malicious download—after which the file bypasses the usual Mark of the Web safeguards like security warnings, Protected View, or outright blocking. Tenable researcher Satnam Narang pointed out this marks the third Windows Shell bug exploited in the wild this year, following CVE-2026-21510 (tied to APT28) and CVE-2026-32202, with it still unclear whether CVE-2026-96951 stems from an incomplete fix for those earlier issues or represents fresh APT28 activity. Separately, ZDI's Dustin Childs highlighted CVE-2026-102866, a critical signature-verification weakness in Microsoft Office SharePoint that lets unauthenticated attackers hijack user accounts by tampering with a stolen proof token, alongside 55 wormable, zero-click remote-code-execution bugs across components such as DHCP Server, Remote Desktop Gateway, and Network Policy Server that administrators are urged to patch promptly.