Microsoft fixes exploited Mark of the Web bypass vulnerability (CVE-2026-96951)

In another record-breaking Patch Tuesday, Microsoft has squashed over 1,400 security bugs, including a Mark of the Web bypass vulnerability (CVE-2026-96951) exploited by attackers in the wild. CVE-2026-96951 is a command injection vulnerability in Windows Shell that can be triggered by remote attackers via a file that is designed to exploit the vulnerability. Such a file can be sent to the user via email, instant message, or collaboration tools like Teams and Slack.