Microsoft recently addressed a critical zero-day vulnerability in Windows Shell, known as CVE-2026-96951, as part of its October 2026 Patch Tuesday updates. The flaw, which carries a CVSS score of 8.8, was being actively exploited by attackers to bypass the Mark of the Web protections. This feature is crucial for identifying files originating from the internet and applying appropriate security warnings. The vulnerability allows unauthorized attackers to execute command injection, thereby bypassing these defenses. The attacks require user interaction, such as opening a specially crafted file delivered through email or instant messaging, making social engineering a key component of the threat. Microsoft has urged users to prioritize the installation of the relevant updates due to confirmed exploitation. While the advisory credits several researchers for identifying the flaw, details about the attackers and their methods remain undisclosed. This omission highlights the importance of swiftly applying updates to mitigate potential risks. Security teams are advised to review Microsoft's Security Update Guide to ensure all affected products receive the necessary patches. Given the active exploitation of this vulnerability, it is crucial to act promptly to secure systems against potential attacks.