Microsoft's October update fixes exploited Windows Shell flaw among record 1,411 bugs
Microsoft released fixes on Oct. 13 for one Windows zero-day that attackers were already exploiting and two flaws whose details were public before patches shipped, as part of an October Patch Tuesday that BleepingComputer counted at 1,411 vulnerabilities, a new monthly record.
The exploited bug, CVE-2026-96951, is a command-injection flaw in Windows Shell that lets an unauthenticated attacker bypass a security feature over a network. Reporting on the release says the feature in question is Mark of the Web, the tag Windows places on downloaded files so that Office Protected View and SmartScreen treat them with suspicion. Bypasses of that kind are a common building block in phishing campaigns, because they strip away the warning a user would otherwise see before opening a malicious file.
What was fixed
Microsoft rated CVE-2026-96951 Important, with a CVSS score of 8.8. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalog the same day and gave federal agencies until Oct. 16 to patch. Microsoft has not said who is behind the attacks or how widely the flaw was used.
The two publicly disclosed flaws are:
- CVE-2026-108398, an untrusted search path problem in .NET Framework that a local attacker can use to bypass a security feature. BleepingComputer reported it can be used to get around Windows Defender Application Control, and credited James Forshaw of Google Project Zero with the discovery.
- CVE-2026-92707, a denial-of-service bug in the open-source MessagePack-CSharp serializer, fixed upstream in versions 2.5.303 and 3.1.9. It affects applications that deserialize untrusted data through a specific formatter path, such as an ASP.NET Core SignalR hub with the MessagePack protocol enabled.
Seventy of the October flaws were rated Critical, most of them remote code execution bugs. The count excludes several hundred other fixes Microsoft shipped earlier in the month. The Canadian Centre for Cyber Security published its own advisory on the rollup (AV26-1038) urging administrators to review and apply the updates.
End of updates for some Windows editions
October's release is also the last security update for Windows 11 version 24H2 Home and Pro and for Windows 10 Enterprise LTSB 2016. Microsoft said it "is the last update available for these editions," so machines still running them will stop getting fixes after this month.
What to do
- Install the October cumulative updates on all supported Windows systems, putting endpoints that open email attachments and downloads first.
- Patch .NET Framework and update any application that bundles MessagePack-CSharp to 2.5.303 or 3.1.9.
- Move devices off Windows 11 24H2 Home and Pro and other editions that have reached end of updates.
- Keep Office macro and attachment controls in place. They give some protection if a file arrives without its Mark of the Web tag.
