↓Skip to main content
  1. News/

A Windows Flaw That Hides the 'Downloaded From the Internet' Warning

·7 mins
Windows Zero-Day Mark of the Web Microsoft Small Business
Table of Contents
On October 13, 2026, Microsoft fixed a flaw in Windows that attackers were already using. It lets a file from the internet skip the warning Windows normally shows before you open it. The fix is a routine update, and the useful question for an owner is whether every PC in the office has it. We explain what the flaw is, what is still unknown, and what to ask your IT person.

What Microsoft says happened #

The flaw is tracked as CVE-2026-96951. Microsoft’s Security Update Guide entry calls it a “Windows Shell Security Feature Bypass Vulnerability.” Windows Shell is the part of Windows that handles files and folders, so it is involved almost every time someone opens something.

Microsoft rates it Important, with a CVSS base score of 8.8. CVSS is the standard 0-to-10 scale for how serious a flaw is. The record was published on October 13, 2026. Two fields matter most for an owner. “Exploited” is marked Yes, meaning attackers were already using it. “Publicly disclosed” is marked No, meaning the details were not made public ahead of the fix. Microsoft also marks “Customer action required” as Yes, so someone in your organization has to make sure the update gets installed.

Microsoft’s description says the flaw is “improper neutralization of special elements used in a command,” which it labels command injection, in Windows Shell. It adds that an unauthorized attacker could use it to bypass a security feature over a network. We are not going to describe how an attacker would do that. What matters is the result, covered next.

Why the downloaded-file warning matters #

Windows puts a hidden label on files that come from the internet. It is called Mark of the Web. The label is what triggers the message many of your staff have seen: this file came from the internet, are you sure you want to open it? That message comes from a feature called SmartScreen. Microsoft Office has a related safeguard called Protected View, and SOCRadar says it also stops engaging when this bypass works.

The warning is a small speed bump, and that is its value. It gives a busy person a reason to stop for a second before opening an unexpected invoice, a “scanned document,” or a shared file. That pause is the whole point of the label. It is the thing that makes someone think before they click.

What “evading” the label means #

Microsoft’s own FAQ says an attacker who successfully exploited this flaw “could evade Mark of the Web (MOTW) defenses.” In plain terms, a file that should carry the internet label may not carry it, and the warning may never appear.

SOCRadar, a security vendor, explains the effect this way: a malicious downloaded file is treated like a trusted local file, so the SmartScreen warning and Office Protected View do not engage. Splashtop, another vendor, says a malicious file sent by email or chat can open without the usual download warnings.

There is a limit here, and the sources are clear about it. Microsoft’s CVSS vector includes “UI:R,” which means user interaction is required. Microsoft’s FAQ says an attacker has no way to force a user to view attacker-controlled content. The person has to be persuaded to act, for example by opening an attachment. For email or instant messages, Microsoft says the attacker could send the targeted user a specially crafted file.

So the flaw does not open the door by itself. It removes one of the things that might have made a person hesitate.

What we do not know #

Several things are not stated by any source we read.

  • Who is using it. Neither Microsoft, CISA, BleepingComputer, SOCRadar nor Splashtop names an attacker. SOCRadar says it links the flaw to no threat actor or campaign. We will not guess.
  • Since when, and against whom. No source says when use began or who was targeted.
  • How it was used. BleepingComputer reports that no details have been shared about how attackers exploited it.
  • Who found it. Microsoft’s record has no acknowledgements section, and BleepingComputer said at publication that who disclosed it had not been shared. SecurityWeek later reported who reported it (see Updates below).

Be careful with the flaw’s name, too, because sources describe it differently. Microsoft’s title says “Security Feature Bypass.” Microsoft’s description says “command injection.” CISA, the U.S. government’s cyber agency, added it to its Known Exploited Vulnerabilities catalog on October 13 and lists it as “Microsoft Windows Command Injection Vulnerability.” These are different labels for one entry. For your purposes, it is a flaw that lets attackers get around the downloaded-file warning.

CISA’s alert says this type of vulnerability is “a frequent attack vector for malicious cyber actors.” It encourages all organizations, not only government agencies, to prioritize entries in that catalog when they patch.

What to do this week #

First, install the October updates. This flaw is one item in a larger release, and we cover the rest of October’s Windows updates separately. Splashtop says this one should be patched on every Windows endpoint first, despite its Important rating.

Second, remind staff to be careful with files they did not expect, especially from email and chat. Do this knowing its limit. We cannot tell you that caution makes anyone safe. The sources only say that the person must still open the file for an attack to work, and that the warning may be missing.

Third, ask your IT person or MSP to confirm the work. SOCRadar suggests rolling the update out first to people who handle the most outside email and downloads, keeping SmartScreen and Office Protected View enforced by policy until every machine is covered, and confirming installation with at least two signals, such as a management-tool report and a vulnerability scan.

What to ask your IT person #

  1. Are the October 13 updates installed on every PC and server, and how many machines are not yet updated?
  2. Who confirms that, and by which two signals, for example a management-tool report plus a scan?
  3. Are the downloaded-file warning (SmartScreen) and Office Protected View still switched on by policy?

A clear, short answer to each is a good sign. A vague answer is a reason to ask again.

How SOC-Lite fits in #

At SOC-Lite, a named analyst reviews your alerts, calls you when one is real, works with your IT person or MSP on the fix, and keeps the evidence. A visibility check is free, it takes 20 minutes, and you talk to us by phone or at your office. Book a visibility check

Updates #

2026-10-22: Microsoft’s entry for CVE-2026-96951 has not changed since October 13. Three additions come from news reporting instead.

  • SecurityWeek reports that the flaw was independently reported to Microsoft by researchers at Fujitsu and Anthropic and by an independent expert. Microsoft’s record still lists no acknowledgements.
  • Tenable’s Satnam Narang, quoted by Help Net Security, says this is the third Windows Shell flaw exploited in the wild this year. The other two are CVE-2026-21510, linked to the APT28 group, and CVE-2026-32202. Narang says it is unclear whether exploitation of this one is linked to APT28. Our statement above that no source names an attacker for this flaw still stands.
  • Help Net Security says the crafted file could arrive by email, instant message, a collaboration tool such as Teams or Slack, or a download from a malicious website.

2026-10-17: First published, based on the sources below as of this date.

Sources #