What Is Mark of the Web? The October 2026 Windows Zero-Day Explained

Mark of the Web is a hidden tag Windows adds to files that came from the internet, so that SmartScreen, Office and File Explorer treat them with extra caution. On October 13, 2026, Microsoft patched CVE-2026-96951, a Windows Shell flaw that lets a crafted file get around that tag, and attackers were already using it. The fix is the October 2026 Windows update; install it and restart.

This guide explains what Mark of the Web does, what the October bug changes, how to check whether you are patched, and how to judge a downloaded file safely.

What is Mark of the Web?

When a browser, email client or chat app saves a file from the internet, Windows records where it came from in a small hidden stream attached to the file, named Zone.Identifier. Microsoft's file system specification describes it as a simple text stream that starts with a [ZoneTransfer] line followed by a zone number. That tag is the "Mark of the Web" (MOTW).

The zone number says how far the file should be trusted. Microsoft's Office documentation lists the values:

By default the mark is only added to files from the Internet and Restricted sites zones, so a typical download or email attachment has ZoneId=3.

What Mark of the Web protects you from

The tag does nothing by itself. Other parts of Windows read it and decide how careful to be:

• SmartScreen checks marked programs and scripts before they run and warns you about unknown or unsafe ones.
• Microsoft Office blocks macros in files with ZoneId=3 by default, according to the same Office documentation.
• File Explorer shows the "This file came from another computer and might be blocked to help protect this computer" notice in a marked file's Properties, with an Unblock checkbox.

That is why attackers want to strip or dodge the mark: a malicious file without it opens with fewer warnings.

What changed with CVE-2026-96951

As of October 17, 2026, this is what Microsoft's advisory and CISA say:

• What it is: a security feature bypass in Windows Shell, classed as a command injection weakness (CWE-77). An attacker who exploits it can evade Mark of the Web defenses.
• Severity: rated Important, with a CVSS 3.1 base score of 8.8.
• How it is used: it needs the victim to open a specially crafted file. Microsoft gives a file sent by email or instant message as an example.
• Status: Microsoft lists it as exploited, and not publicly disclosed before the fix. CISA added it to its Known Exploited Vulnerabilities catalog on October 13 and gave US federal agencies until October 16 to patch.
• Affected systems: supported versions of Windows 11, Windows 10 and Windows Server, listed in the advisory.

Microsoft has not published how the attack works, who is using it or what it delivers. Coverage that goes further than the advisory is guessing, so the practical takeaway is simple: patch, and be wary of unexpected attachments.

How to check you have the October 2026 update

On Windows 11 the fix ships in the cumulative update KB5127648, released October 13, 2026.

1. Open Settings → Windows Update and select Check for updates. Install anything offered and restart.
2. Press Win + R, type winver and press Enter.
3. Compare the build number with the table below. Your build should be this number or higher.

On Windows 10 and Windows Server, install the October 2026 security update from Windows Update. The KB number differs by version, and Microsoft lists each one in the advisory.

If you are on Windows 11 24H2 Home or Pro

Check the version as well as the build. Microsoft's release health page says Windows 11 version 24H2 Home and Pro reached end of updates on October 13, 2026, so this October update is the last one those editions get. The next Windows Shell fix will not reach them.

Microsoft recommends moving to version 25H2 or 26H2. Go to Settings → Windows Update and install the feature update when it is offered. The Windows 11 lifecycle page shows the support dates for each version. Enterprise and Education editions of 24H2 are supported until October 12, 2027.

How to see whether a file has Mark of the Web

File Explorer: right-click the file, choose Properties and look at the bottom of the General tab. If you see "This file came from another computer and might be blocked to help protect this computer" with an Unblock checkbox, the file is marked.

PowerShell: you can read the hidden stream directly:

Get-Content .\invoice.zip -Stream Zone.Identifier

A marked file returns the stream's text, which includes lines like these (browsers may add more):

[ZoneTransfer]
ZoneId=3

If PowerShell reports that it could not open the stream, the file has no mark. That is normal for files you created yourself, but suspicious for something you just downloaded.

Should you unblock a file?

Unblocking removes the mark, and with it the warnings. Both the Properties checkbox and PowerShell's Unblock-File cmdlet delete the Zone.Identifier stream. Only do it when you know exactly where the file came from and why you have it.

Do not turn off zone information for all files to get rid of the prompts. Microsoft's documentation warns that without it, Windows stops warning you about files downloaded from the internet. With an exploited bypass in circulation, the mark is worth keeping.

How to check a download before you open it

Patching closes this particular hole. A few habits catch most malicious files whether or not they carry the mark.

1. Expect the file. Be suspicious of attachments you did not ask for, even from people you know. Their account may be compromised.
2. Check the real file type. Turn on View → Show → File name extensions in File Explorer so that invoice.pdf.exe cannot pass as a PDF. If you do not recognize an extension, look it up with the MIME type lookup.
3. Look inside archives before extracting them. Attacks often arrive as a ZIP file containing a shortcut or script. The ZIP extractor lists an archive's contents in your browser, so you can see a stray .lnk, .js or .exe before anything reaches your desktop.
4. Verify the checksum of software downloads. When a vendor publishes a SHA-256 hash, compare it with the file you received. In PowerShell, run Get-FileHash .\setup.exe (SHA-256 is the default). In a browser, drop the file into File Hash Multi, which computes MD5, SHA-1, SHA-256 and SHA-512 locally without uploading it. A mismatch means the file is not the one the vendor published. How checksums work explains why one changed byte changes the whole hash.

A matching hash proves the file is unchanged, not that the vendor is trustworthy. It protects you from tampered mirrors and corrupted downloads, which is the job it is meant for. Hashing algorithms explained covers why SHA-256 is preferred over MD5 for this.

Common questions

Is Mark of the Web a virus warning? No. It only records that a file came from the internet. A marked file can be completely safe; the tag just tells Windows to check it more carefully before running it.

Does CVE-2026-96951 affect Mac or Linux? No. It is a flaw in Windows Shell, and Microsoft's advisory lists only Windows client and server versions.

Do I need to do anything after installing the update? Restart when Windows asks, then confirm your build with winver. The fix needs no settings change.

Why does a file I created myself have no Unblock option? Windows only adds Mark of the Web to files that arrive from the internet or restricted zones. Files you create, copy from your own drives or receive over a trusted network share usually have no mark, so there is nothing to unblock.

What should I do if I am still on Windows 11 24H2 Home or Pro? Install the October update now, since it is the last one for those editions, then upgrade to 25H2 or 26H2 through Windows Update to keep receiving security fixes.