Key points
- Microsoft patched a record 1,413 vulnerabilities in its October 2026 update, including an actively exploited zero-day.
- The exploited flaw, CVE-2026-96951, allows bypassing the Mark of the Web security feature in Windows Shell.
- Two other zero-days were fixed, including a .NET Framework issue that bypasses Windows Defender Application Control.
Attackers can now bypass Windows security warnings for downloaded files by exploiting a flaw in the Windows Shell. This vulnerability, tracked as CVE-2026-96951, requires users to open malicious attachments or links. Microsoft addressed this actively exploited issue in its October Patch Tuesday release, which also fixed a record-breaking 1,413 vulnerabilities across its products.
In plain English
The Windows Shell flaw undermines the Mark of the Web, a mechanism that flags files from untrusted sources. When this defence is bypassed, systems may not show SmartScreen warnings or activate Office Protected View. According to Malwarebytes Labs, successful exploitation depends on user interaction with crafted content. The vulnerability carries a CVSS score of 8.8, classifying it as high severity.
The background
Microsoft’s October update, released on 13 October 2026, included three zero-day fixes. In addition to the exploited Shell flaw, patches addressed CVE-2026-108398 in .NET Framework and CVE-2026-92707 in MessagePack-CSharp. CrowdStrike analysis noted 75 critical flaws in the release, while BleepingComputer counted 70. Microsoft attributed the high volume of fixes to increased use of AI in vulnerability discovery.
What changes now
Organisations must prioritise patching the Windows Shell vulnerability due to its active exploitation. The large scale of the update presents a management challenge for identifying critical fixes. IT teams should verify that systems receive the October updates to mitigate risks from the Shell bypass and the other disclosed zero-days. No further details on ongoing exploitation campaigns were provided in the source material.
The attacker's path
Teams usually see this technique in initial access phases where social engineering delivers a payload. The weakness relies on users trusting downloaded content despite system warnings. Attackers craft files that strip security metadata, allowing malicious code to run without triggering standard defences. Check whether your environment logs file origin data and ensure endpoint detection tools monitor for unexpected process launches after file execution.
What to do and how to stay safe: Microsoft
- Verify that all Windows devices have installed the October 2026 Patch Tuesday updates.
- Monitor email and messaging systems for attachments or links that prompt immediate file opening.
- Review Windows Event Logs for failed Mark of the Web checks or unusual Shell process activity.
- Ensure endpoint protection policies enforce strict handling of downloaded executables until updates are confirmed.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many vulnerabilities did Microsoft fix in October 2026?
Microsoft addressed a record 1,413 vulnerabilities in its October Patch Tuesday release, according to CrowdStrike and Malwarebytes Labs.
Is the Windows Shell flaw being actively exploited?
Yes, CVE-2026-96951 is an actively exploited zero-day that allows attackers to bypass the Mark of the Web security feature.
What other zero-days were included in the update?
The update also fixed CVE-2026-108398 in .NET Framework and CVE-2026-92707 in MessagePack-CSharp, both publicly disclosed before patching.
