News Vulnerabilities & Zero-Days

Microsoft October 2026 Patch Tuesday fixes exploited Windows Shell zero-day

Microsoft's October 2026 updates fix more than 1,400 vulnerabilities, a record, including CVE-2026-96951, a Windows Shell flaw exploited in the wild that bypasses Mark of the Web protections. CISA gave US federal agencies until 16 October to patch it.

Published Updated
Illustration of a Windows-style desktop where a downloaded file slips past a cracked warning shield.

Key takeaways

  • Microsoft's October 2026 Patch Tuesday fixes more than 1,400 vulnerabilities, a record.
  • CVE-2026-96951, a Windows Shell Mark of the Web bypass, is being exploited in the wild.
  • CISA gave US federal agencies until 16 October to patch CVE-2026-96951.
  • Two other flaws were publicly disclosed before the fix, but neither is listed as exploited.
  • Critical Active Directory and Exchange flaws are rated more likely to be exploited.

Microsoft released its October 2026 security updates on 13 October. They fix more than 1,400 vulnerabilities, the largest Patch Tuesday on record, including one Windows flaw that attackers were already exploiting.

Security firms count the release differently. BleepingComputer counts 1,411, excluding 348 flaws Microsoft fixed earlier in October. Tenable counts 1,407 and SecurityWeek 1,413. About 70 are rated Critical: 70 by BleepingComputer's count and 69 by Tenable's.

Which zero-day is being exploited? #

CVE-2026-96951 is a security feature bypass in Windows Shell, rated 8.8 out of 10. It lets attackers get around Mark of the Web, the tag Windows adds to files downloaded from the internet so that SmartScreen and Office Protected View can warn users or restrict the file.

Microsoft says an attacker could send a crafted file by email or instant message, but the target must open it: "In any case an attacker would have no way to force a user to view attacker-controlled content," Microsoft said, as quoted by SecurityWeek. Microsoft has not shared details of the attacks.

CISA added CVE-2026-96951 to its Known Exploited Vulnerabilities catalog on 13 October and gave US federal civilian agencies until 16 October to fix it.

Which flaws were publicly disclosed before the fix? #

CVE Product Type Notes
CVE-2026-108398 .NET Framework Security feature bypass Can bypass Windows Defender Application Control. Rated 8.8 by Tenable. BleepingComputer credits James Forshaw of Google Project Zero.
CVE-2026-92707 MessagePack-CSharp Denial of service Rated Moderate.

Neither is listed as exploited.

Which other flaws should teams prioritise? #

Tenable highlights these Critical flaws that Microsoft rates "Exploitation More Likely":

  • CVE-2026-70229, remote code execution in Active Directory Domain Services, CVSS 8.1.
  • CVE-2026-70571, remote code execution in Exchange Server, CVSS 8.1.

Tenable also flags CVE-2026-70279, an Exchange Server spoofing flaw rated Important but scored 9.3.

What else changed this month? #

Microsoft introduced "risk cohorts", groups of CVEs that share a question about a customer's environment, to help teams decide what to patch first. Microsoft calls the approach experimental: "Risk cohorts are a starting point, not a final decision."

This was also the last update for Windows 11 Home and Pro version 24H2 and Windows 10 Enterprise LTSB 2016, which reached end of support on 13 October.

What should teams do now? #

  1. Deploy the October updates, starting with CVE-2026-96951 on any machine where users open email attachments or downloaded files.
  2. Prioritise Active Directory and Exchange servers for CVE-2026-70229 and CVE-2026-70571.
  3. Move any Windows 11 24H2 Home or Pro devices to a supported version, since they will get no further fixes.

Sources

  1. Patch Tuesday summary with zero-day and other vendor details, BleepingComputer
  2. Analysis of the October 2026 Patch Tuesday CVEs, Tenable
  3. Report on the exploited zero-day and CISA deadline, SecurityWeek

Questions this raises

How many vulnerabilities did Microsoft fix in October 2026?
More than 1,400. Counts range from 1,407 (Tenable) to 1,413 (SecurityWeek), depending on which earlier October fixes are included.
What does CVE-2026-96951 let attackers do?
It bypasses Mark of the Web, so a malicious downloaded file can open without the usual SmartScreen or Protected View warnings. The user still has to open the file.
Who is exploiting it?
Microsoft has not shared details of the attacks or who is behind them.

MicrosoftZero-DaySecurity UpdatePatch ManagementCISA KEVPatch Tuesday