Vulnerabilities
Microsoft Patch Tuesday Oct 2023: 1,413 Vulnerabilities, Including Actively Exploited Windows Shell Zero‑Day
Microsoft’s October Patch Tuesday released a record 1,413 fixes, including CVE‑2026‑96951, a Windows Shell zero‑day already in use, and two other publicly disclosed zero‑days. Defenders must apply the updates immediately, verify patch status, and monitor for exploitation patterns.
What happened
Microsoft released its largest Patch Tuesday to date, addressing 1,413 vulnerabilities. The update includes CVE‑2026‑96951, a Windows Shell flaw that bypasses the Mark of the Web (MOTW) and is actively exploited, plus CVE‑2026‑108398, a .NET Framework flaw that bypasses Windows Defender Application Control (WDAC), and CVE‑2026‑92707, another publicly disclosed zero‑day.
Impact
Exploitation of CVE‑2026‑96951 requires user interaction with a crafted file, enabling attackers to execute arbitrary code on Windows systems. CVE‑2026‑108398 allows local attackers to run unauthorized applications by exploiting an untrusted search path. CVE‑2026‑92707 presents similar risks. Systems lacking the latest patches are vulnerable to these attacks.
What to do
- Run Windows Update immediately; enable automatic updates to receive the latest patches.
- After installation, verify that the system reports “You’re up to date” and that the specific CVE identifiers are no longer listed in the update history.
- Implement application whitelisting and enforce WDAC policies to reduce the impact of any future bypass attempts.
- Use endpoint detection and response (EDR) to monitor for suspicious file execution patterns that match the known exploitation vectors.
- Consider hardening the MOTW policy and disabling legacy file‑type associations that can be abused by the shell zero‑day.
Microsoft said its AI‑driven vulnerability discovery is expected to increase the number of fixes in future releases.
Related vulnerabilities
Microsoft Patch Tuesday October 2026: 85 Critical Vulnerabilities, 1 Wildly Exploited RCE
Microsoft’s October 2026 update addresses 1,415 flaws, including 85 critical ones. A wild‑exploited Windows Shell command‑injection (CVE‑2026‑96951) and multiple high‑impact RCEs in AD DS, Exchange, Message Queuing, Office, and Hyper‑V are highlighted.
Read briefing
Microsoft September 2026 Patch Tuesday: 964 CVEs, Including Two Zero-Day Exploits (CVE-2026-81963, CVE-2026-85880)
Microsoft released its largest Patch Tuesday to date, addressing 964 CVEs—104 critical and 860 important—including two zero‑day vulnerabilities exploited in the wild. Defenders must prioritize applying updates to affected components such as .NET, Active Directory services, Azure services, Office, and Windows kernel drivers, and verify system integrity.
Read briefing
Microsoft October 2026 Patch Tuesday: 1,413 CVEs, 3 Zero‑Days, 75 Critical Vulnerabilities
Microsoft released security updates for 1,413 CVEs, including three zero‑days—one actively exploited—and 75 critical flaws. The update covers Windows, Office, and Azure services. Defenders should apply patches immediately, verify affected components, and monitor for exploitation attempts.
Read briefing
Microsoft Patch Tuesday 2026: 972 CVEs, 113 Critical, 2 Exploited Zero‑Days
Microsoft released updates for 972 vulnerabilities in September 2026, including 113 critical flaws and two zero‑days that were actively exploited. Defenders must prioritize patching, verify deployment, and monitor for exploitation indicators.
Read briefing