Blog · 2026-10-27 · Gardience Engineering

Mark of the Web CVE-2026-96951: the KBs and how to check

CVE-2026-96951 lets a crafted file skip Windows' downloaded-file warnings and was exploited before the patch. The October 2026 KB and fixed build for each Windows version, a script that checks any machine, and the build-number trap with Server 2025.

When you download a file, Windows tags it as coming from the internet. That tag is called the Mark of the Web, and it is what makes Windows warn you before opening the file, makes SmartScreen check it, and makes Office open it in Protected View. A lot of everyday protection hangs on that one tag.

CVE-2026-96951 is a flaw in the Windows Shell that lets an attacker get around it. If someone opens a specially crafted file, those warnings do not happen. Microsoft rates it 8.8 out of 10 and says it was being exploited before the fix was out. It was patched on October 13, 2026 (Patch Tuesday), and CISA added it to its Known Exploited Vulnerabilities list the same day, with a deadline of October 16 for federal agencies.

If your servers took October's cumulative update, you are covered. The useful question is whether all of them did.

The fix for each Windows version#

These come straight from Microsoft's security update data for October 2026. You are patched if your build is the fixed build or later.

Server Core installations take the same update as the full server. Microsoft's page for the CVE is in the Security Update Guide.

The trap: same build number, different fix#

Look at the first and sixth rows. Windows Server 2025 and Windows 11 24H2 are both build 26100, but Server 2025 is fixed at revision 33650 and Windows 11 at revision 9711.

So a check that only knows "build 26100 is fixed at 9711" will look at an unpatched Server 2025 machine sitting at 26100.33438, see that 33438 is bigger than 9711, and call it patched. It is not. Any script or tool that compares build numbers has to know whether the machine is a server.

This is not a one-off. In Microsoft's October data, 967 CVEs have one fixed revision for Server 2025 and a different one for Windows 11 24H2 on the same build 26100. Every one of them has the same trap.

Check one machine#

In PowerShell:

$v = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
"$($v.ProductName) $($v.InstallationType) build $($v.CurrentBuild).$($v.UBR)"

Compare the build with the table. Do not trust ProductName on Windows 11: it still says "Windows 10" in the registry. InstallationType says Client on Windows 11 and Server or Server Core on Windows Server.

You can also ask for the update by number, though the build is the better test because a later cumulative update replaces an earlier one:

Get-HotFix -Id KB5126646

Check every machine at once#

This script does the comparison for you, server or client, on any machine it runs on:

$v = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
$kind  = if ($v.InstallationType -eq 'Client') { 'client' } else { 'server' }
$build = "$($v.CurrentBuild)-$kind"
$fixed = @{
  '26100-server' = 33650; '20348-server' = 5761; '17763-server' = 9376
  '14393-server' = 9612;  '9600-server'  = 23470
  '26100-client' = 9711;  '26200-client' = 9711; '26300-client' = 9711
  '28000-client' = 3231;  '22631-client' = 7652
}[$build]
$ubr = [int]$v.UBR
if (-not $fixed)       { "$($v.CurrentBuild).${ubr}: not in the fix list, check by hand" }
elseif ($ubr -ge $fixed) { "$($v.CurrentBuild).${ubr}: patched" }
else                   { "$($v.CurrentBuild).${ubr}: NOT patched, needs $($v.CurrentBuild).$fixed" }

Run it however you reach your machines: PowerShell remoting, your RMM tool, or a Group Policy startup script that writes to a share. We ran it from Gardience's Run a command runbook on the Windows 11 25H2 machine in our test lab:

It reports 26200.9711, patched. To make sure the "not patched" answer works too, we ran it again with the revision forced to an older number, and it answered 26200.9000: NOT patched, needs 26200.9711.

Gardience's CVE lookup does the same comparison every day from Microsoft's data, server or client, so we can also just type the CVE in:

Patch#

There is no separate fix for this one. It is in October's cumulative update, so install that and reboot:

• Windows Update or WSUS: approve and install the October 2026 cumulative update for each version, then reboot.
• Offline or air-gapped: download the KB from the Microsoft Update Catalog and install it with wusa.exe <file>.msu /quiet /norestart, then reboot when you can.

The fix is not active until the machine restarts. A server that installed the update but has not rebooted is still exposed, and its build number will not change until it does, which is one more reason to check the build rather than the update history.

Questions#

Which KB fixes CVE-2026-96951?#

October 2026's cumulative update for your version: KB5126646 on Server 2025, KB5126655 on Server 2022, KB5126651 on Server 2019, KB5126868 on Server 2016, KB5126836 on Server 2012 R2, and KB5127648 on Windows 11 24H2, 25H2 and 26H2.

Is it being exploited?#

Yes. Microsoft marked it as exploited when it released the fix, and CISA added it to the Known Exploited Vulnerabilities list on October 13, 2026.

Why does my Server 2025 machine look patched when it is not?#

Windows Server 2025 and Windows 11 24H2 share build number 26100 but are fixed at different revisions: 26100.33650 for Server 2025 and 26100.9711 for Windows 11. A check that does not know which one it is looking at can compare a server against the Windows 11 number and get the wrong answer.

Do I need to reboot?#

Yes. The fix takes effect after the restart, and the build number only changes then.