cyber.hendryadrian.com
Security News · malwarebytes.com

Microsoft’s October Patch Tuesday Fixes 1,413 Vulnerabilities, Including Exploited Windows Zero-Day

· Original article ↗

Summary

Microsoft’s October Patch Tuesday fixes 1,413 vulnerabilities, including an actively exploited Windows Shell zero-day that bypasses Mark of the Web and two other publicly disclosed flaws.

Key points

  • The update addresses a record 1,413 vulnerabilities.
  • CVE-2026-96951 is an actively exploited Windows Shell security-feature bypass that can evade Mark of the Web protections; exploitation requires user interaction, such as opening a crafted file.
  • CVE-2026-108398 is a publicly disclosed .NET Framework flaw that can bypass Windows Defender Application Control and allow unauthorized applications to run locally.
  • CVE-2026-92707 is a publicly disclosed flaw that may let unauthenticated remote attackers exhaust memory in applications processing specially crafted MessagePack data.
  • Users can install the fixes through Windows Update and should check again after restarting.

Article Details

Event Type
Microsoft released its October Patch Tuesday security updates, addressing 1,413 vulnerabilities.
Impact
The updates fix an actively exploited Windows Shell security-feature-bypass zero-day, CVE-2026-96951, which can bypass Mark of the Web protections if a user clicks a link or opens a crafted file. They also address two publicly disclosed flaws: CVE-2026-108398, which can allow a local security-feature bypass involving .NET Framework and Windows Defender Application Control, and CVE-2026-92707, which can allow memory exhaustion in affected applications processing specially crafted MessagePack data.

CVE

CVE-2026-108398Another one to keep an eye on is CVE-2026-108398 (CVSS score 8.8 out of 10), where an untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally. The bypassed feature isCVE-2026-92707Another publicly disclosed vulnerability is CVE-2026-92707 (CVSS score 5.3 out of 10). The flaw can let an unauthenticated remote attacker exhaust memory in affected applications that process specially craftedCVE-2026-96951We’ll start with the actively exploited vulnerability tracked as CVE-2026-96951 (CVSS score 8.8 out of 10), a Windows Shell security feature bypass vulnerability.

Vendors

MicrosoftMicrosoft’s October Patch Tuesday release addresses a record-breaking 1,413 vulnerabilities, including an actively exploited Windows Shell zero-day and two other publicly disclosed flaws.

Products

.NET Frameworkto keep an eye on is CVE-2026-108398 (CVSS score 8.8 out of 10), where an untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally. The bypassed feature is WindowsMessagePack-CSharpattacker exhaust memory in affected applications that process specially crafted MessagePack data. MessagePack-CSharp is a software component that helps applications pack and unpack data in a compact format, making itMicrosoft WindowsMicrosoft’s October Patch Tuesday release addresses a record-breaking 1,413 vulnerabilities, including an actively exploited Windows Shell zero-day and two other publicly disclosed flaws.Windows Defender Application Controlan authorized attacker to bypass a security feature locally. The bypassed feature is Windows Defender Application Control (WDAC), which could lead to the ability to run unauthorized applications on targetWindows ShellMicrosoft’s October Patch Tuesday release addresses a record-breaking 1,413 vulnerabilities, including an actively exploited Windows Shell zero-day and two other publicly disclosed flaws.

Related Articles