Microsoft Patches 1,413 Vulnerabilities, Including Actively Exploited Windows Shell Flaw
Summary
Microsoft patched 1,413 vulnerabilities, including an actively exploited Windows flaw that evades Mark of the Web defenses. Other updates address a publicly known WDAC bypass and a critical Raw Image Extension vulnerability.
Key points
- Microsoft released patches for 1,413 vulnerabilities across Windows, Office, Developer Tools, SharePoint Server, and SQL Server; more than 70 are rated Critical.
- CVE-2026-96951 is actively exploited and could let attackers evade Mark of the Web defenses using a crafted file that requires the target to take action.
- CISA added CVE-2026-96951 to its Known Exploited Vulnerabilities catalog, with federal agencies required to apply fixes by October 16, 2026.
- Publicly known CVE-2026-108398 could let an authenticated attacker bypass Windows Defender Application Control and run code within a protected process, without user interaction.
- CVE-2026-21413, a CVSS 9.8 heap-based buffer overflow in Raw Image Extension, could enable remote code execution when Windows generates a thumbnail or preview of a crafted RAW image.
- Microsoft introduced risk cohorts to help organizations group related CVEs for update prioritization, while advising customers to assess each flaw individually.
Article Details
- Vulnerability Types
- Privilege escalation
- Remote code execution
- Information disclosure
- Mark of the Web defense bypass
- Windows Defender Application Control enforcement bypass
- Heap-based buffer overflow
- Severity
- More than 70 flaws are rated Critical. CVE-2026-21413 has a CVSS score of 9.8; severity ratings for the other specifically described vulnerabilities are not stated.
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
CVE
CVE-2026-108398CVE-2026-108398 has been acknowledged as publicly known at the time of the release of the patches, with Microsoft stating the security flaw could be exploited to bypass Windows Defender Application Control (WDAC)CVE-2026-21413Patches have also been released for a non-Microsoft CVE (CVE-2026-21413, CVSS score: 9.8), a heap-based buffer overflow impacting Raw Image Extension that could result in remote code execution.CVE-2026-92707to James Forshaw with Google Project Zero, while crediting an anonymous researcher for reporting CVE-2026-92707. The security flaw is the second to be tagged as publicly disclosed.CVE-2026-96951Microsoft, which credited Fujitsu's Riku Bamba and Yuya Chudo, as well as Anthropic's Benoit Sevens and a researcher named yhw for reporting CVE-2026-96951, said the vulnerability has been exploited in the wild.
People
Adam BarnettLead Software Engineer at Rapid7; commented on recent Patch Tuesday releases.Benoit SevensCredited by Microsoft for reporting CVE-2026-96951; identified as being with Anthropic.Dustin ChildsHead of Threat Awareness at the Zero Day Initiative; commented on vulnerability discovery and exploitation.James ForshawCredited by Microsoft for discovering CVE-2026-108398; identified as being with Google Project Zero.Mike WaltersPresident and co-founder of Action1; commented on CVE-2026-108398.Riku BambaCredited by Microsoft for reporting CVE-2026-96951.Satnam NarangSenior staff research engineer at Tenable; discussed Microsoft's patched vulnerability volume.yhwCredited by Microsoft for reporting CVE-2026-96951.Yuya ChudoCredited by Microsoft for reporting CVE-2026-96951.
Vendors
Products
Developer ToolsThese include 1,102 flaws in Windows, 134 in Office, 61 in Developer Tools, 36 in SharePoint Server, and 22 in SQL Server. Of these, more than 670 relate to privilege escalation, followed by over 300 remote codeMicrosoft WindowsThese include 1,102 flaws in Windows, 134 in Office, 61 in Developer Tools, 36 in SharePoint Server, and 22 in SQL Server. Of these, more than 670 relate to privilege escalation, followed by over 300 remote codeOfficeThese include 1,102 flaws in Windows, 134 in Office, 61 in Developer Tools, 36 in SharePoint Server, and 22 in SQL Server. Of these, more than 670 relate to privilege escalation, followed by over 300 remote codeRaw Image ExtensionPatches have also been released for a non-Microsoft CVE (CVE-2026-21413, CVSS score: 9.8), a heap-based buffer overflow impacting Raw Image Extension that could result in remote code execution.SharePoint ServerThese include 1,102 flaws in Windows, 134 in Office, 61 in Developer Tools, 36 in SharePoint Server, and 22 in SQL Server. Of these, more than 670 relate to privilege escalation, followed by over 300 remote codeSQL Server1,102 flaws in Windows, 134 in Office, 61 in Developer Tools, 36 in SharePoint Server, and 22 in SQL Server. Of these, more than 670 relate to privilege escalation, followed by over 300 remote code executionWindows Defender Application Controlof the patches, with Microsoft stating the security flaw could be exploited to bypass Windows Defender Application Control (WDAC) enforcement and run unauthorized applications on target systems.