Microsoft Oct Update Fixes 1,413 Flaws, Including Shell Zero-Day Bypassing Security Warnings

Microsoft delivered updates for 1,413 vulnerabilities during its October Patch Tuesday release. The package includes fixes for a Windows Shell flaw that attackers are already exploiting in the wild.

What happened

Microsoft addressed a record 1,413 vulnerabilities in its October 2026 Patch Tuesday update, according to Malwarebytes Labs. The release includes three zero-day flaws: one actively exploited and two publicly disclosed before the patch.

The most urgent fix addresses CVE-2026-96951, a Windows Shell security feature bypass with a CVSS score of 8.8. This vulnerability allows attackers to bypass the Mark of the Web defense, which warns users about potentially unsafe downloaded files.

Successful exploitation of CVE-2026-96951 requires user interaction. Attackers typically send specially crafted files via email or instant message. Users must click a link or open an attachment for the exploit to succeed.

Another critical fix addresses CVE-2026-108398, a .NET Framework vulnerability with a CVSS score of 8.8. This flaw allows an authorized attacker to bypass Windows Defender Application Control locally by exploiting an untrusted search path.

CVE-2026-92707 is a third zero-day, rated 5.3 on the CVSS scale. It affects MessagePack-CSharp, allowing unauthenticated remote attackers to exhaust memory in applications that process specially crafted data.

Why it matters

The sheer volume of fixes creates a complex patching landscape for IT teams. Microsoft stated that its increased use of AI to find and fix vulnerabilities will lead to more fixes in monthly updates.

The actively exploited zero-day is particularly dangerous because it undermines a core Windows defense mechanism. Bypassing the Mark of the Web prevents SmartScreen warnings and Office Protected View from activating.

This bypass capability allows malicious files to run without the usual security prompts. Users may unknowingly execute harmful code because the system fails to flag the file as originating from an untrusted source.

What to watch

• Verify that systems are receiving the October Patch Tuesday updates.
• Check for signs of Mark of the Web bypass attempts in email logs.
• Monitor for unusual memory consumption in services using MessagePack-CSharp.
• Review .NET Framework configurations for unauthorized application execution.

Who needs to act first

Teams should prioritize updating systems exposed to external emails and instant messages. Deploy patches to workstations that handle untrusted file attachments first. Test updates in a non-production environment to ensure stability before widespread rollout. Back up critical data before applying changes. If a reboot is required, schedule it during maintenance windows to minimize disruption.

Background: CVSS score

The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.

Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes

What to do and how to stay safe: Microsoft

• Ensure automatic Windows Update settings are enabled to receive patches promptly.
• Educate users to avoid opening unexpected attachments or clicking links in messages.
• Verify that Windows Defender Application Control policies are correctly configured.
• Monitor system logs for any anomalies following the patch deployment.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Windows versions are affected by the October updates?

The updates apply to Windows 11 versions 24H2 and 25H2, as well as other Microsoft products.

Does the exploited zero-day require user interaction?

Yes, successful exploitation of CVE-2026-96951 requires a user to open a crafted file or click a link.

How many vulnerabilities were fixed in total?

Microsoft addressed 1,413 vulnerabilities in the October Patch Tuesday release.