Microsoft October 2026 Patch Tuesday: exploited Windows Shell flaw and two public zero-days
By BleepingComputer’s count the October updates fixed 1,411 flaws, plus 348 earlier in the month, and other outlets count differently.
Affects
Windows Shell
What to do
Deploy the October 2026 Windows updates now, then the .NET Framework fix and the MessagePack-CSharp upgrade.
On this page
- Patch Tuesday
- CVEs
- CVE-2026-96951CVE-2026-108398CVE-2026-92707
- CVSS
- 8.8 (v3.1, Microsoft, CVE-2026-96951, via NVD)8.8 (v3.1, Microsoft, CVE-2026-108398, via NVD)5.3 (v3.1, GitHub, CVE-2026-92707, via NVD)
- Exploitation
- Exploited, in the CISA catalogue
- Affected
- Windows (Windows Shell)
- .NET Framework
- MessagePack-CSharp before 2.5.303 and 3.1.9
- Fixed in
- October 2026 Windows and .NET security updates
- MessagePack-CSharp 2.5.303 and 3.1.9
How the exploited flaw works
It is command injection in Windows Shell that bypasses a security feature over the network. BleepingComputer reports the feature is Mark of the Web, the label that makes Windows warn before it opens a downloaded file.
What to do now
The exploited flaw goes first.
- Deploy the October Windows cumulative updates to workstations first, then servers, inside 48 hours.
- Confirm installation from the update management console, and chase every device that has not reported in.
- Install the October .NET Framework updates wherever application control is enforced.
- Upgrade MessagePack-CSharp to 2.5.303 or 3.1.9 in any .NET application that deserialises untrusted data.
- Block Office macros for users with no business need by policy. Internet macro blocking relies on Mark of the Web.
Who is affected
Every supported Windows device that has not installed the October updates. CVE-2026-108398 is a .NET Framework flaw that lets an authorised local attacker bypass a security feature, which BleepingComputer reports is Windows Defender Application Control. CVE-2026-92707 is a denial of service in the MessagePack for C# library, and applies only to software that deserialises attacker-controlled data with it.
Detection notes
Microsoft has not published how CVE-2026-96951 was used. A Mark of the Web bypass usually arrives as a downloaded file or archive that opens without the usual warning, so email and browser download telemetry is the place to look.
- Archives, shortcut files or disk images opened from Downloads that spawn a script host or command shell
- Office documents from the internet that open with no Protected View banner
- Application control blocks or audit events that stop appearing after a .NET update is skipped
Essential Eight mapping
Patch operating systems: the Essential Eight Maturity Model sets 48 hours for internet-facing services where a working exploit exists, and this flaw is exploited. Application control and Microsoft Office macro settings reduce what a file that slips past the warning can run.
Sources
- PrimaryCISA, Known Exploited Vulnerabilities Catalog (release 2026.10.23)Retrieved 25 Oct 2026
- PrimaryNVD, CVE-2026-96951Retrieved 25 Oct 2026
- PrimaryNVD, CVE-2026-108398Retrieved 25 Oct 2026
- PrimaryNVD, CVE-2026-92707Retrieved 25 Oct 2026
- SecondaryBleepingComputer, Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-daysRetrieved 25 Oct 2026
