Microsoft fixes a Windows flaw that is already exploited
October's batch has 1 411 flaws, the largest yet per BleepingComputer, but only CVE-2026-96951 is under attack, and it already has a patch.
Microsoft released its monthly security update on Oct. 13, known as Patch Tuesday, with fixes for 1 411 vulnerabilities, according to BleepingComputer, which calls it the largest batch to date. One of them, CVE-2026-96951, is already used in attacks and is fixed in this same release. Zero Day Initiative, part of Trend Micro, advises testing and installing that patch quickly.
The flaw is in Windows Shell, the component that runs the system interface, and lets an attacker get around the Mark of the Web, the label Windows attaches to files downloaded from the internet so it can warn the user before they open them. Zero Day Initiative rates it Important, with a CVSS score of 8.8, and it is the only flaw in the release listed as exploited. Microsoft describes it, according to BleepingComputer, as a flaw that lets an unauthorized attacker bypass a security feature over a network. Rapid7 adds that the user would have to open a crafted file or visit an attacker-controlled site.
Some details that Microsoft's advisory should clarify could not be checked by this outlet: the affected versions and the update numbers. BleepingComputer says it has not been disclosed who reported the flaw or how it was exploited. Rapid7 reports that Windows Server 2012 gets no patch and that Windows Server 2012 R2 does.
Two other flaws were already public before the patch, with no known exploitation:
- CVE-2026-108398, in .NET Framework, can bypass Windows Defender Application Control; it was found by James Forshaw of Google Project Zero.
- CVE-2026-92707, in the MessagePack-CSharp library, causes a denial of service and is rated Moderate.
BleepingComputer counts 70 critical flaws in total, and Rapid7 highlights five remote code execution flaws in Outlook that can be triggered from the preview pane.
With this release, Windows 11 24H2 Home and Pro and Windows 10 Enterprise LTSB 2016 receive their last security update, according to BleepingComputer. Anyone on those editions will have to move to another version to keep getting patches.
The total changes depending on who counts: Rapid7 adds up 1 413 and Zero Day Initiative 1 415, while BleepingComputer leaves out 348 flaws fixed earlier in October. The figures remain unconfirmed in Microsoft's advisory.
