Last week this looked like a zero-day-free Patch Tuesday — one of the largest Microsoft has ever shipped, north of 1,400 fixes, with nothing marked as under active attack. That read didn't hold. CVE-2026-96951, a command-injection weakness in Windows Shell, turns out to have been exploited in the wild before the patch, and CISA added it to its known-exploited catalog the same day with a federal deadline of October 16. The flaw bypasses Mark of the Web, the tag Windows puts on downloaded files to trigger SmartScreen and Office Protected View. Skip that tag and a crafted file opens with no warning. It's rated Important at CVSS 8.8 and needs a user to open a malicious file or visit an attacker's site, so it reads as a phishing payload. Windows 10 and 11 and Server 2012 R2 through 2025 are covered — but Server 2012 gets no patch for this one.