Microsoft October 2026 Patch Tuesday: Windows Shell CVE-2026-96951 (CVSS 8.8) Mark of the Web bypass exploited as a zero-day; .NET Framework WDAC bypass CVE-2026-108398 publicly disclosed; record 1,411 fixes

Microsoft's October 2026 security updates, released on 13 October 2026, fix one actively exploited zero-day and two publicly disclosed flaws. CVE-2026-96951 is a Windows Shell security feature bypass (command injection) that lets an unauthenticated attacker get around Mark of the Web protections over a network once a user opens a crafted file or link; Microsoft rates it Important, CVSS 8.8, and marks it 'Exploitation Detected'. It has not said who reported it or how it was used. CVE-2026-108398 is a .NET Framework untrusted search path flaw (CVSS 8.8) that lets a local, authenticated attacker register a crafted .NET assembly for loading by a protected process and bypass Windows Defender Application Control (WDAC); it was publicly disclosed and found by James Forshaw of Google Project Zero, but is not marked exploited. CVE-2026-92707 is a publicly disclosed MessagePack-CSharp denial of service (CVSS 5.3). BleepingComputer counts a record 1,411 flaws fixed on Patch Tuesday itself, 70 of them Critical (57 remote code execution), not counting 348 cloud and other fixes released earlier in the month. Critical remote code execution bugs rated CVSS 9.8 by Microsoft include Windows DHCP Server (CVE-2026-96934), Windows Message Queuing (CVE-2026-100202), Microsoft QUIC (CVE-2026-100219, CVE-2026-105016), Windows Text Shaping (CVE-2026-97814) and several Outlook bugs, all rated 'Exploitation Less Likely'. October is also the last update for Windows 11 24H2 Home and Pro and Windows 10 Enterprise LTSB 2016. UPDATE 15 October: the WA Government's Cyber Security Unit (WASOC) issued advisory 20261015001 for CVE-2026-96951, saying Microsoft is aware of exploitation and CISA has added it to its Known Exploited Vulnerabilities catalogue. WASOC has had no reports of exploitation on WA Government networks and recommends applying Microsoft's fix within expected timeframes. UPDATE 16 October: Microsoft added a known issue to the KB5127648 release notes for Windows 11 24H2, 25H2 and 26H2: after the update, some devices cannot turn Smart App Control back on in the Windows Security app if it was off, and the option may be greyed out. Devices that already have Smart App Control on are not affected and stay protected. Microsoft gives a registry workaround and two Feature Preview Group Policies for managed devices, and says a fix will come in an upcoming release. Separately, on 13 October MSRC published a blog proposing 'risk cohorts': provisional groups of CVEs that need the same check of a customer's environment (for example, 64 RDP client, gateway and server CVEs share the question of which roles are deployed and exposed; an Office cohort of 119 CVEs includes 23 rated Critical and 17 needing no user interaction). MSRC says these are not a new classification or prioritisation framework, do not change its update guidance, and do not appear in the Security Update Guide for now.

Product

Microsoft Windows (Windows Shell, DHCP Server, MSMQ, QUIC), .NET Framework, Microsoft Office/Outlook

Versions

Supported Windows client and server releases, .NET Framework and Office builds before the October 2026 security updates (see MSRC per-CVE tables). Windows 11 24H2 Home/Pro and Windows 10 Enterprise LTSB 2016 receive their final update this month.

CVSS

8.8 (CVE-2026-96951, Microsoft); 8.8 (CVE-2026-108398); top Critical RCEs 9.8

Exploited in Australia?

unknown

Patch to

Install the October 2026 cumulative updates now (Windows 11 KB5127648 / KB5126653, Windows 10 ESU KB5126657 per BleepingComputer) and the matching .NET Framework and Office updates. Prioritise endpoints where users open email attachments and downloads (CVE-2026-96951), then DHCP, MSMQ and QUIC-exposed servers. Treat Mark of the Web as one layer only: keep Office macro blocking and attachment filtering in place. Move Windows 11 24H2 Home/Pro devices to a supported release. If Windows 11 devices need Smart App Control turned back on after KB5127648, use the registry or Group Policy workaround in Microsoft's KB5127648 notes.

Primary: Microsoft Security Response Center — October 2026 Security Updates release notes (13 Oct 2026) · Vendor: MSRC — CVE-2026-96951 Windows Shell Security Feature Bypass Vulnerability · CVE: CVE-2026-96951, CVE-2026-108398, CVE-2026-92707, CVE-2026-96934, CVE-2026-100202, CVE-2026-100219, CVE-2026-105016, CVE-2026-97814 · BleepingComputer — Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days (13 Oct 2026)

vulnerabilities