October 2026 Patch Tuesday: A Record Release and One Exploited Windows Shell Bug

Microsoft's October 13, 2026 Patch Tuesday fixed roughly 1,400 vulnerabilities, the largest release the company has shipped, and one of them was already being exploited. That flaw, CVE-2026-96951, sits in Windows Shell and lets a crafted file slip past Mark of the Web protections. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog the same day and gave federal agencies until October 16.

The headline count depends on who does the counting. Tenable reports 1,407 CVEs, BleepingComputer 1,411, and THN 1,413. Microsoft's previous record, in September, was close to 1,000.

For most teams the useful number in this release is one. The rest of the list still matters, but the order of work starts with a single Windows Shell fix.

CVE-2026-96951: The Windows Shell Flaw Under Active Exploitation

Microsoft describes CVE-2026-96951 as a command injection weakness (CWE-77) in Windows Shell that lets an unauthorized attacker bypass a security feature over a network. Microsoft scores it 8.8 (High) on CVSS 3.1. NVD had not finished its own analysis at the time of writing. Microsoft says the flaw was exploited in the wild before the fix shipped, and who is behind it and who was targeted remains unclear.

The attack needs a person to act. Per Microsoft, an attacker has to get the target to open a malicious file, for example by sending a link or an attachment in an email or an instant message, and cannot force a user to view attacker-controlled content on their own.

The security feature that fails is Mark of the Web (MOTW), the tag Windows puts on files that come from the internet. Automox, quoted by Dark Reading, says a crafted file can bypass the tag so Windows treats it like a locally created file. The controls that read the tag then stand down: SmartScreen, Office Protected View, the Office macro block, Smart App Control, and the Attachment Manager prompt. CISA lists ransomware use as unknown.

KrebsOnSecurity reports that Windows 10 and 11 are affected, plus some Windows Server versions. VulnTracker lists 20 affected products, among them Windows 11 23H2, Windows 11 24H2, and Windows Server 2016. For Windows 11 24H2, 25H2, and 26H2, reporting points to KB5127648 as the update that carries the fix. Microsoft credits four reporters, including researchers from Fujitsu and Anthropic.

Other Flaws Worth Your Time

No other CVE in the release carries an exploited-in-the-wild flag, but several deserve a place near the front of the queue.

.NET Framework (CVE-2026-108398)

An untrusted search path flaw that lets an authenticated local attacker bypass Windows Defender Application Control (WDAC). The attacker places a crafted .NET assembly and registers it for loading by a protected process, with no user interaction. It was publicly disclosed before the patch, and Microsoft credits James Forshaw of Google Project Zero. CVSS is 8.8, and Microsoft rates exploitation as less likely. Action1 notes there is no official workaround, so teams that rely on WDAC should patch and watch for unexpected assembly loads.

MessagePack-CSharp (CVE-2026-92707)

An improperly controlled memory allocation that lets an unauthenticated attacker cause denial of service over a network. It is the second flaw tagged as publicly disclosed, and its CVSS score is 5.3. Early coverage mixed up the advisory links for this CVE and CVE-2026-108398, so check IDs against Microsoft's guide before you copy them into tickets.

Critical remote code execution

Microsoft rates Active Directory Domain Services (CVE-2026-70229) and Exchange Server (CVE-2026-70571) as Critical at 8.1 and marks both Exploitation More Likely. The first needs a crafted packet, and the second a malicious email. Dark Reading also flags an Outlook Reading Pane flaw (CVE-2026-70242, 9.8) that works without opening the message, and an unauthenticated QUIC flaw (CVE-2026-105016, 9.8).

Raw Image Extension (CVE-2026-21413)

A non-Microsoft heap overflow, scored 9.8, that can run code when Windows generates a thumbnail or preview, so the user never opens the file.

Risk cohorts

Microsoft also introduced "risk cohorts," groups of CVEs that call for a similar customer assessment. The company calls them a starting point and still asks customers to review each CVE for exploitation, exposure, and product context.

One Exploited Flaw in 1,400 Fixes

The release breaks down as 1,102 Windows CVEs, 134 in Office, 61 in developer tools, 36 in SharePoint Server, and 22 in SQL Server, according to THN. More than 670 are privilege escalation bugs and more than 300 are remote code execution. Roughly 70 are rated Critical, though trackers disagree on the exact figure.

Against that, one flaw is confirmed as exploited. Fortra's Tyler Reguly told Dark Reading that 26 Microsoft CVEs have reached KEV so far in 2026, compared with 30 last year and 32 the year before, which is under 1 percent of Microsoft's 2026 patches. Reguly's own conclusion was that the volume figures are meaningless and the exploited count is the signal.

Dustin Childs of the Zero Day Initiative adds that AI is speeding up bug discovery on both sides, so vendors are fixing more flaws and researchers are finding them faster. Teams that triage by CVE count will spend their month on the wrong list. A workable order for this release is the KEV entry first, then the publicly disclosed flaws, then the Critical remote code execution bugs Microsoft marks as more likely to be exploited, and the rest through normal cycles.

Reading It on VulnTracker

Open CVE-2026-96951 and the Actively Exploited banner at the top gives the two dates that matter: added to KEV on October 13, 2026, with remediation due October 16, 2026. The CVSS panel shows Microsoft's 3.1 score of 8.8, and the status reads Undergoing Analysis because NVD has not published its own assessment or CPE entries yet.

The Affected Products list carries 20 entries with the version where each product is affected, such as 10.0.22631.0 for Windows 11 23H2 and 10.0.14393.0 for Windows Server 2016. Use it to match your own inventory, and press Track CVE to follow the entry. SSVC marks the flaw Not automatable with Total technical impact, which fits a bug that needs a user to open a file and then removes the safeguards around that file.

What to Do This Week

The federal deadline is October 16, so treat that date as the target for any Windows endpoint that handles email or chat attachments.

• Deploy the October cumulative update to Windows 10 and 11 endpoints first, starting with machines that open outside files all day. Windows 11 24H2, 25H2, and 26H2 use KB5127648. Install the latest servicing stack update beforehand, and confirm the build number on the device, not only that the KB shows as installed.
• Do not let Mark of the Web carry the full load until patching is done. Keep Office macro blocking, Protected View, and SmartScreen on, and tighten mail filtering for archives and shortcut files, because the bypass defeats those checks one level down.
• On systems that use WDAC, install the .NET Framework update for CVE-2026-108398 and alert on unexpected assemblies loaded into protected processes.
• Patch Exchange Server, Active Directory domain controllers, and Outlook in the same window if you run them, since Microsoft marks the first two as more likely to be exploited.
• Move on from Windows Server 2012 and 2012 R2. Extended Security Updates ended October 13, 2026, so these hosts no longer receive fixes.

A record patch count makes for a loud headline, and the work still starts with the one flaw attackers already use. Install the Windows Shell fix, keep file-handling protections on while you do, and let the exploited and publicly disclosed entries set the order for everything else. Track Microsoft and the Windows products you run on VulnTracker, and the next Patch Tuesday zero-day will reach you with its KEV date and due date already attached.

References

Vendor: MSRC advisory for CVE-2026-96951. NVD: CVE-2026-96951. Analysis: THN, KrebsOnSecurity, Dark Reading, Tenable, WindowsForum, NTCompatible.