Microsoft’s October 2026 Patch Tuesday, released on Oct. 13, closes a Windows Shell hole that attackers were already using before the fix existed. The flaw is tracked as CVE-2026-96951, carries a severity score of 8.8 out of 10, and is the only vulnerability in the batch that Microsoft lists as exploited in the wild. It arrives inside what outside trackers describe as the largest monthly release the company has put out.
Anyone running Windows 10, Windows 11 or a supported Windows Server should treat the cumulative update as the priority this week. The other two zero-days in the batch are not known to be exploited, but both were disclosed publicly before patches shipped, which is why they are counted alongside it.
The exploited Windows Shell bypass
CVE-2026-96951 is a Windows Shell security feature bypass. According to BleepingComputer’s account of the release, it lets an attacker get around Mark of the Web, the marker Windows attaches to files that came from the internet so the system can warn before they run. Microsoft’s own wording describes a command injection flaw in the Shell that “allows an unauthorized attacker to bypass a security feature over a network.” No one has published how attackers used it or who reported it to Microsoft.
Pieter Arntz, a malware intelligence researcher at Malwarebytes, wrote on Oct. 14 that “successful exploitation requires user interaction,” meaning a target would typically have to click a link or open an attachment delivered by email or instant message. That makes the bug a natural partner for phishing: a safety prompt that would normally appear on a downloaded file simply does not. Windows Shell is part of every desktop install, so the affected population is broad.
The practical effect of a Mark of the Web bypass is easy to underestimate. Malwarebytes describes Mark of the Web as the defense that warns users about potentially unsafe downloaded files, so a defect that gets around it removes that warning at exactly the moment a file arrives from outside. The attacker still has to get a file or link in front of a person, but the person no longer sees the prompt that would have made them hesitate. Neither BleepingComputer nor Malwarebytes reports who is behind the attacks that prompted the fix.
How many fixes, and why the totals disagree
Counts for the month vary by who is doing the arithmetic. Senserva’s Patch Tuesday tracker lists 1,760 CVEs across 55 updates, with 174 rated Critical, 1,433 Important, 128 Moderate and 23 Low. BleepingComputer counted 1,411 flaws, 70 of them critical. Malwarebytes put the figure at 1,413, and Ivanti’s October roundup says 1,407, including 78 Critical.
The spread is large enough that none of the numbers should be quoted as definitive without checking Microsoft’s own Security Update Guide, and Senserva’s page itself carries a second, conflicting summary of 1,256 CVEs across 65 updates in a different section. What the trackers agree on is the shape: a record-scale release, a heavy Critical count, mostly remote code execution, and exactly one flaw confirmed as exploited. BleepingComputer also notes that the total leaves out 348 flaws fixed earlier in the month.
Two publicly disclosed zero-days
The other two zero-days count as such because details were public before patches arrived, not because attacks have been confirmed. CVE-2026-108398 is a .NET Framework security feature bypass, also scored 8.8. BleepingComputer reports that Microsoft says it could let an attacker bypass Windows Defender Application Control and run unauthorized applications, and that James Forshaw of Google Project Zero discovered it. Malwarebytes describes the mechanism as an untrusted search path that an authorized local attacker can abuse.
CVE-2026-92707 sits in MessagePack-CSharp, a serialization library, and is scored 5.3. An unauthenticated remote attacker can exhaust memory in applications that parse specially crafted MessagePack data, so exposure depends on whether a given service uses the library at all. Ivanti advises patching the Shell flaw first, then the .NET bypass, since public disclosure raises the chance that working exploit code follows.
The month’s release landed against a busier backdrop than Windows alone. Ivanti’s roundup says Adobe shipped 141 CVEs across 10 bulletins and Mozilla fixed 79 unique CVEs, and it points to edge devices from Citrix NetScaler, FortiMail, SonicWall SMA1000 and Ivanti Connect Secure that were under attack before Patch Tuesday. It also flags a Critical remote code execution flaw, CVE-2026-70571, in Exchange Server 2016 and 2019, whose final extended security update period ends on Oct. 31, so administrators face a deadline as well as a patch.
Patch Tuesday coverage and Windows Update checks
Per Senserva’s listing, the Windows packages include KB5126657 for Windows 10 21H2 and cover Windows 11 from 23H2 through 26H1, along with Windows 10 1809 and 1607. BleepingComputer names KB5127648 and KB5126653 for Windows 11 and KB5126657 for Windows 10’s extended security updates. It also notes this is the last update for Windows 11 version 24H2 Home and Pro and for Windows 10 Enterprise LTSB 2016, which have reached the end of their update windows.
Because the Shell bug is exploited, it is also the kind of entry the federal government tracks: the CISA Known Exploited Vulnerabilities catalog is where federal agencies and other defenders look for flaws with confirmed attacks, and Senserva’s page counts one October addition to it. Home users can open Settings, choose Windows Update, select Check for updates, install what appears and restart, then check again until Windows reports that the device is up to date, which is the sequence Malwarebytes recommends.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
More from Morning Overview
