cyber.hendryadrian.com
Vulnerability & Exploit · securityweek.com

Microsoft Fixes Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day

· Original article ↗

Summary

Microsoft's October 2026 updates fix 1,413 vulnerabilities, including an exploited Windows flaw that bypasses Mark of the Web protections. CISA added the zero-day to its KEV catalog and set an October 16 deadline for federal agencies.

Key points

  • The updates address 1,413 CVEs, including 1,102 affecting Windows, 134 in Office, 61 in developer tools, and 36 in SharePoint Server.
  • CVE-2026-96951 is an exploited Windows shell security feature bypass that can evade Mark of the Web protections, allowing malicious files to run without warnings.
  • The described attack requires sending a specially crafted file and persuading the target to take action; Microsoft says attackers cannot force users to view attacker-controlled content.
  • CISA added CVE-2026-96951 to its Known Exploited Vulnerabilities catalog and directed federal agencies to address it by October 16.
  • Two other flaws were disclosed before fixes became available: CVE-2026-108398 bypasses Windows Defender Application Control, while CVE-2026-92707 is a denial-of-service flaw in MessagePack-CSharp.
  • Microsoft introduced risk cohorts to help customers prioritize updates, while advising them to assess each CVE against exploitation, severity, attack vector, and product-specific guidance.

Article Details

Vulnerability Types
  • Windows shell security feature bypass
  • Windows Defender Application Control enforcement bypass
  • Denial of service
Severity
CVE-2026-96951 has a CVSS score of 8.8/10; severity of the other vulnerabilities is not specified.
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available

CVE

CVE-2026-108398One of them is CVE-2026-108398, which allows an attacker to bypass Windows Defender Application Control (WDAC) enforcement.CVE-2026-92707The second, which Microsoft has not assessed for exploitability, is CVE-2026-92707.CVE-2026-96951The exploited zero-day is tracked as CVE-2026-96951 (CVSS score 8.8/10).

Vendors

MicrosoftMicrosoft’s October 2026 Patch Tuesday updates fix a record-breaking number of vulnerabilities, including a Windows zero-day exploited in the wild.

Products

.NETIt’s a DoS vulnerability affecting the MessagePack-CSharp component in Visual Studio and .NET.AzureExchange Server, Azure, Defender, and other products also received security patches.DefenderExchange Server, Azure, Defender, and other products also received security patches.Defender SmartScreenMotW tags internet-downloaded files, signaling security mechanisms like Defender SmartScreen and Office Protected View to restrict automatic execution.MessagePack-CSharpIt’s a DoS vulnerability affecting the MessagePack-CSharp component in Visual Studio and .NET.Microsoft Exchange ServerExchange Server, Azure, Defender, and other products also received security patches.Microsoft WindowsMicrosoft’s October 2026 Patch Tuesday updates fix a record-breaking number of vulnerabilities, including a Windows zero-day exploited in the wild.OfficeAccording to Microsoft, the latest updates resolve 1,413 CVEs, including 1,102 affecting Windows, 134 in Office, 61 in developer tools, and 36 in SharePoint Server.Office Protected ViewMotW tags internet-downloaded files, signaling security mechanisms like Defender SmartScreen and Office Protected View to restrict automatic execution.SharePoint ServerAccording to Microsoft, the latest updates resolve 1,413 CVEs, including 1,102 affecting Windows, 134 in Office, 61 in developer tools, and 36 in SharePoint Server.Visual StudioIt’s a DoS vulnerability affecting the MessagePack-CSharp component in Visual Studio and .NET.Windows Defender Application ControlOne of them is CVE-2026-108398, which allows an attacker to bypass Windows Defender Application Control (WDAC) enforcement.

Related Articles