Microsoft releases fixes for 1,413 vulnerabilities, including exploited Windows Shell flaw
Microsoft has issued security fixes for a record 1,413 vulnerabilities in its October 2026 Patch Tuesday release, including CVE-2026-96951, a Windows Shell vulnerability that has been exploited in the wild. The release includes 1,102 Windows flaws, 134 affecting Office, 61 in Developer Tools, 36 in SharePoint Server and 22 in SQL Server.
More than 670 of the vulnerabilities involve privilege escalation, while the update also addresses over 300 remote code execution issues and 250 information disclosure flaws. More than 70 vulnerabilities carry a Critical severity rating. Microsoft has patched nearly 1,000 vulnerabilities in the prior month, and Tenable said the company has addressed more than 4,000 CVEs so far this year.
Exploited Windows Shell issue can evade Mark of the Web
CVE-2026-96951 has a CVSS score of 8.8 and is a command injection vulnerability in Windows Shell. Microsoft said an unauthorized attacker could use it over a network to bypass a security feature. The company credited Fujitsu researchers Riku Bamba and Yuya Chudo, Anthropic's Benoit Sevens and a researcher known as yhw for reporting the flaw.
A successful attack could evade Mark of the Web defenses. In an email or instant-message scenario, an attacker could send a specially crafted file, but Microsoft said the attacker cannot force a target to view attacker-controlled content. The attack instead depends on persuading a user to click a link leading to an attacker-controlled site or to interact with a malicious attachment.
The U.S. Cybersecurity and Infrastructure Security Agency has added CVE-2026-96951 to its Known Exploited Vulnerabilities catalog. Federal civilian agencies must apply the fix by October 16, 2026. Microsoft did not disclose how the vulnerability has been used, who is behind the activity or which targets have been affected.
Other flaws include WDAC bypass and RAW image code execution
Microsoft also fixed CVE-2026-108398, an 8.8-rated untrusted search path vulnerability in .NET Framework that was publicly known when patches were released. An authenticated attacker could place a crafted .NET assembly on an affected system and register it for loading by a protected process. Microsoft said successful exploitation could bypass Windows Defender Application Control enforcement and execute code within that process without user interaction.
Google Project Zero researcher James Forshaw reported CVE-2026-108398. Microsoft also addressed CVE-2026-92707, a publicly disclosed MessagePack-CSharp memory allocation flaw rated 5.3 that can allow an unauthorized attacker to cause denial of service over a network.
Another notable update covers CVE-2026-21413, a non-Microsoft vulnerability in Raw Image Extension rated 9.8. The heap-based buffer overflow could lead to remote code execution when Windows generates a thumbnail or preview for a specially crafted RAW image in a folder; Microsoft said the user does not need to open the image file.
Microsoft adds risk cohorts for patch assessment
Microsoft has introduced “risk cohorts,” which group CVEs requiring a similar customer assessment. The company described them as a starting point rather than a final decision, advising customers to assess each vulnerability for active exploitation, severity, attack vector, user interaction and product-specific guidance.
Dustin Childs of the Zero Day Initiative said AI is accelerating vulnerability discovery and remediation, shortening the interval between a flaw's existence and its identification. For security teams, the immediate business implication is to deploy the exploited Windows Shell fix first, determine exposure to the affected products, and use risk cohorts to structure assessments while retaining CVE-level prioritization.