Microsoft Addresses Critical Mark of the Web Bypass Vulnerability (CVE-2026-96951)

Post Views: 4

Microsoft resolved over 1,400 security vulnerabilities, including a critical Windows Shell flaw (CVE-2026-96951) actively exploited by threat actors.

Overview of the Vulnerability

During a significant Patch Tuesday release, Microsoft addressed over 1,400 security vulnerabilities, including a command injection flaw in the Windows Shell component (CVE-2026-96951) that has been actively exploited by threat actors. This vulnerability allows remote adversaries to execute arbitrary commands by leveraging specially crafted files designed to bypass security mechanisms.

Details of the Windows Shell Flaw

Attackers can deliver these files through instant messaging platforms or collaboration tools such as Teams and Slack, requiring user interaction to initiate the exploit. Once triggered, the malicious file circumvents the Mark of the Web protections, which typically alert users to potential risks, open files in Protected View, or block execution entirely.

Third Vulnerability Exploited in the Wild

This marks the third Windows Shell vulnerability exploited in the wild this year, according to Satnam Narang, a senior staff research engineer at Tenable. The prior incidents involved CVE-2026-21510, linked to the APT28 threat group (Fancy Bear), and CVE-2026-32202, which addressed an incomplete patch for the earlier flaw.

According to Satnam Narang, a senior staff research engineer at Tenable: “This marks the third Windows Shell vulnerability exploited in the wild this year.”

Other Critical Flaws Highlighted in Update

Dustin Childs, head of threat awareness at Trend Micro’s Zero Day Initiative, emphasized the urgency of addressing CVE-2026-102866, a critical cryptographic signature verification flaw in Microsoft Office SharePoint. This vulnerability enables unauthenticated attackers to hijack user accounts by manipulating valid proof tokens.

Cryptographic Signature Verification Flaw in SharePoint

While the exploit requires initial access to obtain a token, multiple methods exist for acquisition, including phishing or compromised systems. Microsoft classified the flaw as less likely to be exploited due to strict environmental prerequisites, such as specific protocol configurations.

Wormable RCE Vulnerabilities in Critical Infrastructure

The update also addressed 55 wormable remote code execution (RCE) vulnerabilities affecting critical infrastructure components, including DHCP Server, Remote Desktop Gateway, and Network Policy Server. Childs noted that advancements in artificial intelligence are accelerating vulnerability discovery but not creating new flaws.

Said Dustin Childs: “Organizations should focus on patching confirmed, publicly disclosed issues rather than prioritizing CVE counts, as exploitability metrics are now more critical than sheer volume.”

Conclusion

Security teams are urged to prioritize deployment of the latest patches, as the flaw is actively being leveraged by malicious actors. Additional critical flaws, including SharePoint-related vulnerabilities and broader Windows Server improvements, highlight the importance of prompt patching to mitigate risks associated with emerging attack vectors.