Microsoft has patched an active Windows Shell zero-day vulnerability that enables attackers to bypass Webmark protections This article explores zero click attack. . Identified as CVE-2026-96951, this flaw was addressed in the October 2026 Patch Tuesday updates.

A Windows Shell zero-day exploit has been discovered, where the system fails to properly handle special elements in commands. Attackers can deliver a specially crafted file via email or instant messaging and use social engineering to convince the target to open it. Exploitation requires user action, meaning the flaw should not be treated as a zero-click attack, despite its network-based delivery path. Earlier reports highlighted another method for Windows LNK stomping attacks to circumvent Mark of the Web through shortcuts.

The provided Microsoft advisory credits Riku Bamba, Yuya Chudo, and Benoit Sevens, along with Claude and Anthropic, and researcher yhw. Security teams should focus on applying relevant Windows updates and reviewing Microsoft’s Security Update Guide for impacted products. Users should be cautious of unexpected attachments, as this attack relies on tricking someone into interacting with attacker-controlled content.