{
  "id": 16479616,
  "title": "CVE-2026-96951: The Mark-of-the-Web Bypass and the Limits of Trust-on-Download",
  "url": "https://urgent.news/2026/10/25/cve-2026-96951-the-mark-of-the-web-bypass-and-the-limits-of-trust-on",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-25T13:43:39.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/ioneyrezende/cve-2026-96951-the-mark-of-the-web-bypass-and-the-limits-of-trust-on-download-228p"
  },
  "original_language": "en",
  "account": "CVE-2026-96951 is a security vulnerability that allows a Mark-of-the-Web (MoTW) bypass in Windows. This flaw impacts the trust-on-download model that Windows relies on to protect users from malicious files. The update to address this vulnerability marks the highest CVSS rating of 8.8, highlighting its severity. Microsoft confirmed that this vulnerability was being exploited in the wild by the time of the October 2026 Patch Tuesday release.\n\nThe Mark-of-the-Web is a security control that marks files downloaded from the internet and applies additional security measures. When this bypass is exploited, it undermines the MoTW control, allowing files to bypass security measures like SmartScreen and Office's Protected View. This can result in the execution of untrusted code without warning or protection. The second vulnerability, CVE-2026-108398, was disclosed alongside CVE-2026-96951 and allows for bypassing Windows Defender Application Control, potentially enabling the execution of unauthorized applications.\n\nThis vulnerability is unique because it affects the trust model rather than causing a direct code execution. Once the MoTW mark is removed, multiple layers of security are bypassed, making it particularly dangerous. Traditional detection methods, which rely on warning signs or specific behaviors, may not trigger alerts in this scenario. The recommended solution is to apply the October 2026 cumulative updates for Windows and enhance application control policies to include additional criteria beyond MoTW marking. Additionally, organizations should consider implementing multi-layered security measures, such as hash-based allowlisting, network restrictions, and execution context detection, to provide more robust protection against this and similar threats.",
  "summary": "CVE-2026-96951: The Mark-of-the-Web Bypass and the Limits of Trust-on-Download Windows has one widely relied-upon control for files arriving from the internet: the Mark-of-the-Web. It is the reason SmartScreen evaluates a downloaded executable, the reason Office opens a document in Protected View, and the reason a user sees a warning before running something from an email attachment.…",
  "key_points": [
    "CVE-2026-96951 allows Mark-of-the-Web bypass in Windows.",
    "Vulnerability marked highest CVSS rating of 8.8.",
    "Exploitation confirmed in the wild before October 2026 Patch Tuesday."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}