Microsoft’s record October Patch Tuesday fixes exploited Windows Shell flaw

Microsoft’s October security updates, released on October 13, fix more than 1,400 vulnerabilities, including a Windows Shell flaw that attackers were already exploiting to get around the Mark of the Web protection for downloaded files. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the bug to its Known Exploited Vulnerabilities (KEV) catalog the same day.

Counts vary with method. Tenable tallied 1,407 CVEs across 301 products and components: 69 rated critical, 1,337 important and one low. Tenable called it the second consecutive month to set a new record for the largest Patch Tuesday release. BleepingComputer counted 1,411 flaws, 70 of them critical, and said its total leaves out 348 flaws Microsoft fixed earlier in October in services including Azure components, Exchange Server and Microsoft Bookings.

Elevation of privilege bugs made up 47.9% of the release and remote code execution flaws 22.3%, according to Tenable. The most-patched products were Microsoft Office Excel with 69 CVEs, the DNS Server role with 52 and the Windows Kernel with 46. BleepingComputer attributed the record volume to Microsoft’s continued use of AI platforms to find and fix flaws.

The exploited zero-day

The actively exploited bug, CVE-2026-96951, is a security feature bypass in Windows Shell rated important with a CVSSv3 score of 8.8, Tenable said. Microsoft’s description, quoted by BleepingComputer, calls it an improper neutralization of special elements used in a command, a form of command injection, that lets an unauthorized attacker bypass a security feature over a network. The feature in question is Mark of the Web, which BleepingComputer describes as the Windows protection against malicious downloads.

According to Tenable, exploitation requires social engineering: a target has to be persuaded, by email or message, to open a malicious file. It is the third Windows Shell flaw exploited in the wild this year, after CVE-2026-21510 in February and CVE-2026-32202 in April. BleepingComputer reported that Microsoft shared no details on how attackers used the flaw or who reported it.

CISA listed CVE-2026-96951 in the KEV catalog on October 13, alongside an authentication bypass in Ivanti Connect Secure, CVE-2026-104935. Under Binding Operational Directive 26-04, federal civilian agencies must prioritize fixing high-risk KEV entries on publicly exposed assets, and CISA encourages all organizations to prioritize KEV vulnerabilities.

Two publicly disclosed flaws

Microsoft also fixed two flaws that were publicly disclosed before a patch was available. CVE-2026-108398, a .NET Framework security feature bypass with a CVSSv3 score of 8.8, could let an attacker get past Windows Defender Application Control (WDAC) and run unauthorized applications, according to BleepingComputer and Tenable. BleepingComputer credited the discovery to James Forshaw of Google Project Zero. The second, CVE-2026-92707, is a denial-of-service flaw in MessagePack-CSharp for .NET that Microsoft says an unauthorized attacker could trigger over a network.

Other fixes to prioritize

Tenable highlighted two critical remote code execution flaws that Microsoft rates as “Exploitation More Likely”: CVE-2026-70229 in Active Directory Domain Services and CVE-2026-70571 in Exchange Server, both scored 8.1. It also flagged CVE-2026-70279, an Exchange Server spoofing flaw scored 9.3 that requires a user to click a malicious link.

To help administrators triage, Microsoft introduced what it calls risk cohorts, 15 groups of related flaws, including 136 filesystem, storage and backup bugs and 135 Office and mail client bugs, BleepingComputer reported. According to the report, Microsoft described the approach as experimental and said the groups do not necessarily show which flaws are the most dangerous.

End of support

For several products this is the last update. BleepingComputer reported that Windows 11 version 24H2 Home and Pro and Windows 10 Enterprise LTSB 2016 have reached end of support, and that Windows 11 23H2 Enterprise, Education and IoT Enterprise stop receiving security updates next month. Tenable said Extended Security Updates for Windows Server 2012 and 2012 R2 ended on October 13, and that Office 2021 and Office LTSC 2021 have also reached end of support.

Why it matters

A Mark of the Web bypass strips away a protection meant to guard users against malicious downloads, and Tenable notes that this one is used by persuading targets to open a malicious file sent by email or message. With exploitation confirmed by Microsoft and the bug on CISA’s KEV list, it stands out in an unusually large release.

The volume also matters for patch teams. Microsoft’s risk cohorts are an experimental attempt to help them prioritize, and, according to BleepingComputer, they do not replace Microsoft’s existing patching recommendations. BleepingComputer also listed exploited flaws patched this month by other vendors, including an Ivanti Connect Secure zero-day, Fortinet FortiMail CVE-2026-104286 and Citrix NetScaler CVE-2026-88779.

The caveats

Totals differ between Tenable and BleepingComputer because they count different sets of advisories, and Microsoft has not shared details of how CVE-2026-96951 was exploited. Severity scores and exploitability ratings come from Microsoft’s assessments as reported by the two sources.

Corrections and tips: email the editor using the address on the Contact page.