CVE-2026-96951: The Mark-of-the-Web Bypass and the Limits of Trust-on-Download

CVE-2026-96951 is a security vulnerability that allows a Mark-of-the-Web (MoTW) bypass in Windows. This flaw impacts the trust-on-download model that Windows relies on to protect users from malicious files. The update to address this vulnerability marks the highest CVSS rating of 8.8, highlighting its severity. Microsoft confirmed that this vulnerability was being exploited in the wild by the time of the October 2026 Patch Tuesday release.

The Mark-of-the-Web is a security control that marks files downloaded from the internet and applies additional security measures. When this bypass is exploited, it undermines the MoTW control, allowing files to bypass security measures like SmartScreen and Office's Protected View. This can result in the execution of untrusted code without warning or protection.

The second vulnerability, CVE-2026-108398, was disclosed alongside CVE-2026-96951 and allows for bypassing Windows Defender Application Control, potentially enabling the execution of unauthorized applications.

This vulnerability is unique because it affects the trust model rather than causing a direct code execution. Once the MoTW mark is removed, multiple layers of security are bypassed, making it particularly dangerous. Traditional detection methods, which rely on warning signs or specific behaviors, may not trigger alerts in this scenario.

The recommended solution is to apply the October 2026 cumulative updates for Windows and enhance application control policies to include additional criteria beyond MoTW marking. Additionally, organizations should consider implementing multi-layered security measures, such as hash-based allowlisting, network restrictions, and execution context detection, to provide more robust protection against this and similar threats.