Microsoft fixes 1,413 flaws, one Windows Shell bug already exploited

Microsoft fixes 1,413 flaws, one Windows Shell bug already exploited

13 October 2026: Microsoft's October security release covers 1,413 Microsoft CVEs, and one of them, CVE-2026-96951 in Windows Shell, was already being used in attacks when the fixes shipped. The flaw lets a crafted file slip past Mark of the Web, the tag Windows puts on downloaded files so that Office and SmartScreen treat them with suspicion. CISA added it to its Known Exploited Vulnerabilities catalogue the same day and gave US federal civilian agencies until 16 October to patch.

The exploited Windows Shell flaw

Microsoft rates CVE-2026-96951 important, with a CVSS score of 8.8, and describes it as command injection in Windows Shell that lets an unauthorised attacker bypass a security feature over a network. Its FAQ is specific about the feature: a successful attacker "could evade Mark of the Web (MOTW) defenses". The attack needs the victim to open a file sent by email or instant message, or to follow a link, so it is a tool for phishing rather than for breaking into servers directly. Microsoft credits four researchers, two of them at Fujitsu.

A Mark of the Web bypass matters because so many other defences hang off that tag: Protected View in Office, SmartScreen warnings and many attachment rules all rely on Windows knowing a file came from the internet. Bypasses of this kind were used by ransomware crews in 2022 and 2023 to get macro-laden documents past users.

A second flaw was public before the fix: CVE-2026-108398, a security feature bypass in .NET Framework, also scored 8.8. Microsoft reports no exploitation of it.

Where the 1,413 fixes fall

Microsoft's release notes break the month down by product family:

• Windows: 1,102 vulnerabilities across 39 updates
• Office: 134
• Developer tools: 61
• SharePoint Server: 36
• SQL Server: 22
• Azure: 15
• Exchange Server: 7
• Defender: 4
• other products: 32

By our count of Microsoft's machine-readable release data, 72 of the CVEs first published on release day are rated critical and 55 carry a CVSS score of 9.8 or higher. The critical list leans on services that are reachable without a user doing anything: the Windows DHCP Server (CVE-2026-96934 at 9.8, plus four more at 8.1), Message Queuing (CVE-2026-100202 at 9.8), Microsoft's QUIC implementation (CVE-2026-100219 and CVE-2026-105016, both 9.8) and Remote Desktop Services. Outlook carries five critical remote code execution flaws at 9.8, and Exchange Server gets a critical one, CVE-2026-70571, across Subscription Edition, 2019 and 2016.

Which updates to install

The Windows cumulative updates carry all of the month's Windows fixes. The main ones are KB5127648 for Windows 11 versions 24H2, 25H2 and 26H2, KB5127646 for Windows 11 26H1, KB5126646 for Windows Server 2025, KB5126655 for Windows Server 2022 and KB5126657 for Windows 10 21H2 and 22H2. Exchange Server Subscription Edition takes KB5129955, and SQL Server has separate GDR and CU packages for 2017, 2019, 2022 and 2025.

AD FS hardening moves to enforcement

The same Windows update switches a change for Active Directory Federation Services from audit to enforcement. A Message Center notice says the hardening of access rights on the AD FS key container (tracked as CVE-2026-56155) is now enforced and is remediated automatically unless an administrator has opted out, while Windows Server 2012 and 2012 R2 need manual remediation. Microsoft asks AD FS owners to check for event ID 1132 in the AD FS admin log before and after patching.

Microsoft in our catalogue

We list Microsoft as a company, and our patch management category lists 7 products, among them Patch Connect Plus, KACE and Panda Adaptive Defense 360.

Related on TrustList:

• Microsoft 365 and Azure: 40 dated changes admins must act on by spring 2027

Sources

• Microsoft Security Response Center: October 2026 Security Updates (release notes and CVRF data), 13 October 2026
• Microsoft Security Update Guide: CVE-2026-96951, 13 October 2026
• CISA: Known Exploited Vulnerabilities catalogue (CVE-2026-96951 added), 13 October 2026
• Microsoft 365 Message Center MC1506287 via a public archive (AD FS DKM hardening), 13 October 2026