Cybersecurity news tracks attackers stripping the Mark of the Web so payloads run without SmartScreen warnings. This 60-second check shows whether your files still carry the mark — and what a missing tag means.
Windows tags downloaded files with the Mark of the Web, triggering SmartScreen warnings and blocking macros. Attackers bypass it with ISO, VHD, and archive tricks so payloads run silently. When the tag is stripped, your first line of download defense is gone — and most users never notice. This check shows whether your files still carry the mark and what a missing tag means.
The Mark of the Web bypass is a technique that strips or avoids the security tag Windows applies to downloaded files, so malicious downloads open without SmartScreen warnings or macro blocks.
A file you downloaded just opened with no warning at all. That silence is the warning. Microsoft's October 2026 Patch Tuesday fixed CVE-2026-96951 (CVSS 8.8) — a Windows Shell flaw that strips the Mark of the Web, the tag that tells SmartScreen, Office Protected View, and Smart App Control to treat a file as untrusted. It was already being exploited in the wild when the patch landed. Six questions below tell you whether your PC is still exposed.
Short answer: every file Windows downloads from the internet gets a hidden tag called Zone.Identifier — the Mark of the Web. CVE-2026-96951 delivers files with the tag silently missing, so they open like files you created yourself. If your machine has the October 2026 cumulative update, the bypass is closed. If it doesn't, every download is suspect.
CVE-2026-96951 is a Windows Shell flaw (CVSS 8.8) that strips the Mark of the Web — the Zone.Identifier tag Windows attaches to internet downloads. Without the tag, files open like local files: no SmartScreen warning, no Office Protected View, no Smart App Control block. Microsoft patched it in the October 2026 update; unpatched PCs stay exposed.
Answer for the Windows PC you use every day.
Right-click the file → Properties. If you see a Security line reading "This file came from another computer and might be blocked to help protect this computer" with an Unblock checkbox, the Mark of the Web is attached. No Security line at all? The file carries no tag.
Open PowerShell and run:
Get-Item -Path "C:\path\to\file.exe" -Stream Zone.Identifier
If it prints a block containing ZoneId=3, the file is tagged as from the Internet. If it errors or prints nothing, no Mark of the Web exists on that file. To see the raw tag:
Get-Content -Path ".\file.exe" -Stream Zone.Identifier -Raw
| Value | Meaning |
|---|---|
ZoneId=0 | My Computer — created locally |
ZoneId=1 | Local intranet |
ZoneId=2 | Trusted sites |
ZoneId=3 | Internet — downloaded from the web |
ZoneId=4 | Restricted sites |
Note: the tag lives in an NTFS alternate data stream, so it only survives on NTFS drives. Copying a file to a FAT32 USB stick, or extracting it with some third-party archivers, can strip it without any attacker involved — which is why a missing tag is a warning flag, not proof of attack.
Unblock-File — legitimate if they verified the source, dangerous if you don't know who did it.Absence of MotW never proves a file is safe. Presence of MotW never proves a file is dangerous. It is one signal — and this CVE turned off the signal.
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5Unblock-File remove the tag permanently. Only clear it after you personally verified who sent the file and why.Ticking the boxes is local to this page (nothing is uploaded anywhere). Missed one? Do it, then re-take the check above.
| Fact | Detail |
|---|---|
| The flaw | CVE-2026-96951 — command injection in Windows Shell that defeats the Mark-of-the-Web security feature. CVSS 8.8. Attacker sends a specially crafted file (email or instant message); the victim must be convinced to open it — the attacker cannot force it. |
| What it bypasses | SmartScreen warnings, Office Protected View, and Smart App Control — all at once — because all three consult the MotW tag the flaw strips. |
| Exploitation | Confirmed exploited in the wild as a zero-day before disclosure. Microsoft has not published details of the attacks. CISA added it to the Known Exploited Vulnerabilities catalog on October 13, 2026, with a federal remediation deadline of October 16. |
| The patch | Microsoft's October 2026 Patch Tuesday (October 13) — a record ~1,413 CVEs fixed, per Microsoft's tally reported by SecurityWeek. (BleepingComputer counted 1,411; tallies differ slightly by what researchers include.) |
| Discovery | Independently reported by researchers at Fujitsu, Anthropic (Benoit Sevens, assisted by Claude AI), an independent researcher, and Google's James Forshaw. |
Sources: SecurityWeek — "Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day"; independent technical analysis of CVE-2026-96951. Patch-Tuesday context per Microsoft's October 2026 release, as reported by The Hacker News, SecurityWeek, and TechRepublic.
Mark of the Web (MotW) is a Zone.Identifier alternate data stream that Windows NTFS attaches to files downloaded from the internet or received from untrusted sources. When MotW is present, Windows applies extra caution: Microsoft Defender SmartScreen warnings, Office Protected View for documents, and Smart App Control blocks. Think of it as the 'from the internet' sticker every guard in the building checks.
Right-click the file, choose Properties, and look for a Security line reading 'This file came from another computer and might be blocked' with an Unblock checkbox — that means MotW is attached. Or in PowerShell run: Get-Item -Path 'C:\path\to\file.exe' -Stream Zone.Identifier. Output containing ZoneId=3 (Internet) means the tag is present; no output means the file carries no MotW.
Three possibilities. Benign: some extraction tools and transfer methods strip the alternate data stream. Suspicious: someone deliberately removed it with Unblock-File. Dangerous: on an unpatched system, the CVE-2026-96951 bypass silently delivered the file with no tag. If a file you just downloaded from the internet shows no Zone.Identifier, treat it as hostile until verified — and make sure the October 2026 update is installed.
Right-click the file, choose Properties, and tick the Unblock checkbox at the bottom — this permanently removes the Zone.Identifier tag. In PowerShell, run Unblock-File -Path 'C:\path\to\file'. Only remove the tag from files you personally verified as safe: unblocking also removes SmartScreen and Protected View coverage for that file.
The October 2026 cumulative update closes the bypass on your machine, so MotW enforcement works normally again. You still need the hygiene: SmartScreen on, Office Protected View on, and never Unblock a file you weren't expecting. The bypass needs a vulnerable Shell to fire, so a patched system is not affected by it.