Microsoft's October Patch Tuesday Fixes Over 1,400 Flaws. One Is Already Under Attack.

Microsoft's October security update is the biggest in the company's history, and one of the flaws inside it was already being used in real attacks before the fix arrived. On October 13, Microsoft released its October 2026 Patch Tuesday updates, addressing more than 1,400 vulnerabilities across Windows, Office, Exchange, SharePoint, .NET, SQL Server and other products. It tops September's record of more than 970 fixes, and security teams are being told to treat one item on the list as an emergency.

The urgent item is CVE-2026-96951, a flaw in Windows Shell that attackers are actively exploiting. Microsoft rated it Important with a CVSS score of 8.8, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalog on October 13, giving federal civilian agencies until October 16 to patch. The other two zero-days in this month's release were publicly disclosed before a fix existed, but neither has confirmed in-the-wild exploitation yet.

The flaw that matters: CVE-2026-96951

The exploited flaw is a command injection weakness in Windows Shell, the part of the operating system behind File Explorer. Microsoft's own description says it allows an unauthorized attacker to bypass a security feature over a network. The prize for the attacker is bypassing Mark of the Web, the mechanism Windows uses to flag files downloaded from the internet.

Mark of the Web is the small zone identifier Windows attaches to files that arrive from outside your machine. When it is present, opening the file triggers a warning dialog, or the file opens in read-only Protected View in Office, or it is blocked outright. When the marker is stripped, none of that happens. CrowdStrike's analysis explains that once the flag is gone, downstream defenses that rely on it, including SmartScreen warnings, Office Protected View and Application Guard, no longer apply.

This one is not a zero-click attack. Exploitation requires social engineering: an attacker sends a specially crafted file by email, instant message, or collaboration tools such as Teams and Slack, or lures the target into downloading it from a malicious website, and the target has to open it. But the security control being bypassed is precisely the one designed to warn the user before that action turns dangerous. That makes it a natural fit for phishing campaigns and initial access brokers, who prize anything that reduces the number of warning dialogs standing between a click and code execution.

The bypassed warning is the one designed to fire exactly when a user is about to make a mistake. That is what makes this class of flaw so useful to attackers.

The affected population is effectively the entire Windows install base. The vulnerability spans Windows 10 (1607, 1809, 21H2 and 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2012 R2, 2016, 2019, 2022 and 2025. It even reached Microsoft's own cloud: Outlook.com was affected by the same underlying issue, though Microsoft patched the service several weeks ago in a build dated September 25. One vintage holdout is out of luck entirely: Windows Server 2012 receives no patch for this flaw, although Server 2012 R2 does.

Why Windows Shell keeps producing exploited zero-days

This is the third flaw in Windows Shell that was exploited in the wild in 2026, according to Tenable senior staff research engineer Satnam Narang. The first, CVE-2026-21510, was patched in February's Patch Tuesday and has been linked to the state-backed group APT28, also known as Fancy Bear. The second, CVE-2026-32202, patched in April, was itself a fix for an incomplete earlier patch, and its exploitation has not yet been attributed. Narang noted that it remains unclear whether CVE-2026-96951 exists to address another incomplete fix or whether the latest exploitation is connected to the earlier campaigns.

The recurrence points to a structural problem. Windows Shell is present on every Windows endpoint, which means every discovered bypass instantly has a billion-machine attack surface. Mark of the Web bypasses in particular are catnip for attackers because they neutralize the user's last line of defense without disabling any antivirus or endpoint detection, which means the compromise often generates no alarm at all. Rapid7's analysis of this month's release called out that the advisory credits reporters from multiple outside organizations but none from within Microsoft, a reminder that much of this class of bug hunting now happens externally.

The two other zero-days

Microsoft labels a flaw a zero-day when it is publicly disclosed or actively exploited before an official fix exists, and under that definition this month brings three. The other two carry risk even without confirmed exploitation.

CVE-2026-108398 is a .NET Framework security feature bypass, also scored 8.8, found by Google Project Zero researcher James Forshaw. An attacker who registers a malicious .NET assembly to be loaded by a protected process could bypass Windows Defender Application Control (WDAC) and execute code inside a trusted context, which is exactly the kind of primitive attackers use to run tooling past allowlisting defenses.

CVE-2026-92707 is a denial-of-service flaw in MessagePack-CSharp, an open-source serialization library for .NET. Improper control of memory allocation lets a remote attacker crash applications that use the library, with no authentication required. It is rated lower at CVSS 5.3, but availability attacks against .NET services are cheap to mount and annoying to triage.

A record-breaking month in numbers

Strip out the zero-days and this is still a historically large release. More than 1,400 vulnerabilities were fixed across 176 individual updates. Tenable's breakdown shows elevation of privilege flaws accounting for 47.9 percent of the haul, with remote code execution at 22.3 percent. The product with the most fixes was Microsoft Office Excel at 69, followed by DNS Server at 52 and the Windows Kernel at 46. A separate critical-rated remote code execution flaw in Windows Active Directory Domain Services, CVE-2026-70229, scored 8.1 and carries Microsoft's own assessment of exploitation more likely.

The release also included a housekeeping announcement with real consequences: Windows 11 version 24H2 Home and Pro editions have reached the end of support. Machines still on that build will no longer receive security updates, so machines on that build need an upgrade to a supported release.

What to do now

Patch the exploited flaw first. Microsoft's cumulative updates for October include the Windows Shell fix, and CISA's catalog entry sets an October 16 deadline for federal agencies that the rest of the industry should treat as a strong suggestion. The headline KB numbers are KB5127648 for Windows 11 versions 26H2, 25H2 and 24H2, KB5127646 for Windows 11 26H1, KB5126657 for Windows 10 21H2 and 22H2, KB5126646 for Windows Server 2025 and KB5126655 for Windows Server 2022, with separate updates for SQL Server and Exchange Server available from the Microsoft Update Catalog.

Until patches land, the standard advice applies with renewed urgency: treat files arriving by email, chat or download with suspicion, and do not let the absence of a warning dialog reassure you. That warning was the thing under attack. And if anything in your fleet still runs Windows Server 2012, which gets no fix for this flaw, or Windows 11 24H2 Home or Pro, which now gets no security updates at all, October's record release is the month to deal with them.