/
← Voltar ao feed
high exploit público

Microsoft October 2026 Patch Tuesday fixes 1,407 CVEs, including Windows Shell MOTW bypass zero-day CVE-2026-96951 exploited in the wild

1 fonte(s) · 1 atualização(ões) · publicado 13/10/2026 18:49 · coletado há 1 dia

Microsoft's October 2026 Patch Tuesday addresses 1,407 CVEs across 301 products and components, the largest release on record for the second consecutive month. 69 are rated critical, 1,337 important and 1 low. Two zero-days are fixed: CVE-2026-96951, a Windows Shell security feature bypass exploited in the wild, and CVE-2026-108398, a .NET Framework WDAC bypass that was publicly disclosed before a patch was available. Elevation of Privilege accounts for 47.9% of the fixes and remote code execution for 22.3%. The release also marks end of support for several Microsoft products.

Technical Details

  • CVE-2026-96951 (CVSSv3 8.8, important): Windows Shell security feature bypass, exploited as a zero-day. An attacker uses social engineering by email or message to get the target to open a malicious file, which bypasses Mark of the Web (MOTW). It is the third Windows Shell flaw exploited in the wild in 2026, after CVE-2026-21510 (February) and CVE-2026-32202 (April).
  • CVE-2026-108398 (CVSSv3 8.8, important): .NET Framework security feature bypass, publicly disclosed before a patch. An attacker registers a malicious .NET assembly that a protected process loads, bypassing Windows Defender Application Control (WDAC).
  • CVE-2026-70229 (CVSSv3 8.1, critical): Active Directory Domain Services RCE via a crafted packet. Rated "Exploitation More Likely".
  • CVE-2026-70571 (CVSSv3 8.1, critical): Exchange Server RCE. A malicious email triggers code execution during internal content conversion. Rated "Exploitation More Likely".
  • CVE-2026-70279 (CVSSv3 9.3, important): Exchange Server spoofing via a malicious link. Against an administrative target it allows access to or modification of organizational data. Rated "Exploitation More Likely".
  • Other "Exploitation More Likely" flaws: CVE-2026-100214 (Dynamics Business Central RCE), CVE-2026-88159 (BITS RCE), CVE-2026-102217 (WebDAV EoP), CVE-2026-69918 (Core Messaging EoP), CVE-2026-96940 (Exchange EoP), and several EoP flaws in Windows Update, Desktop Window Manager, Windows AI and NetBIOS.
  • Products with the most CVEs: Microsoft Office Excel (69), DNS Server (52), Windows Kernel (46), Windows Installer (38), Win32 Kernel Subsystem (36).

Remediation

  • Apply the October 2026 security updates as soon as possible. Prioritize CVE-2026-96951, the Exchange Server and Active Directory Domain Services flaws, and the "Exploitation More Likely" items.
  • Windows Server 2012 and 2012 R2 ESU ended on October 13, as did extended support for Windows 10 Enterprise 2016 LTSB and IoT Enterprise LTSB 2016. Tenable plugin IDs 192813, 182965 and 192817 can identify these systems.
  • Mainstream support for Windows Server 2022 ended on October 13. It now moves to extended support through October 14, 2031.
  • Also past end of support: Office 2021, Office LTSC 2021 (including Mac), Skype for Business LTSC 2021, and Windows 11 Home and Pro 24H2. Upgrade these to supported versions.

Exploit público

Há código de exploração publicado no Exploit-DB para CVE-2026-32202. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.

  1. exploit-db.com · EDB-52601 ↗ · remoto · windows · pub. 29/05/2026 não verificado

    Microsoft - NTLMv2 Hash Capture

    This script targets a Windows Shell (File Explorer) spoofing flaw, CVE-2026-32202, by generating a shortcut (.lnk) whose path points to an attacker-controlled SMB server. The attacker must place the file in a folder the victim browses, and the victim's machine must reach the attacker's SMB service; no click is claimed, only viewing the folder. The outcome is a leaked NetNTLMv2 hash that can be cracked or relayed. It is a rough, unverified proof of concept: the hand-built file looks crude and may not trigger reliably.

    CVE-2026-32202 · autor: nu11secur1ty · explicação gerada por IA

Linha do tempo

  1. tenable.com ↗ · pub. 13/10/2026 18:49 · coletado 19/10 18:00 primeiro registro

    Microsoft October 2026 Patch Tuesday fixes 1,407 CVEs, including Windows Shell MOTW bypass zero-day CVE-2026-96951 exploited in the wild

    ler a análise desta fonte

    Microsoft's October 2026 Patch Tuesday addresses 1,407 CVEs across 301 products and components, the largest release on record for the second consecutive month. 69 are rated critical, 1,337 important and 1 low. Two zero-days are fixed: CVE-2026-96951, a Windows Shell security feature bypass exploited in the wild, and CVE-2026-108398, a .NET Framework WDAC bypass that was publicly disclosed before a patch was available. Elevation of Privilege accounts for 47.9% of the fixes and remote code execution for 22.3%. The release also marks end of support for several Microsoft products.

    Technical Details

    • CVE-2026-96951 (CVSSv3 8.8, important): Windows Shell security feature bypass, exploited as a zero-day. An attacker uses social engineering by email or message to get the target to open a malicious file, which bypasses Mark of the Web (MOTW). It is the third Windows Shell flaw exploited in the wild in 2026, after CVE-2026-21510 (February) and CVE-2026-32202 (April).
    • CVE-2026-108398 (CVSSv3 8.8, important): .NET Framework security feature bypass, publicly disclosed before a patch. An attacker registers a malicious .NET assembly that a protected process loads, bypassing Windows Defender Application Control (WDAC).
    • CVE-2026-70229 (CVSSv3 8.1, critical): Active Directory Domain Services RCE via a crafted packet. Rated "Exploitation More Likely".
    • CVE-2026-70571 (CVSSv3 8.1, critical): Exchange Server RCE. A malicious email triggers code execution during internal content conversion. Rated "Exploitation More Likely".
    • CVE-2026-70279 (CVSSv3 9.3, important): Exchange Server spoofing via a malicious link. Against an administrative target it allows access to or modification of organizational data. Rated "Exploitation More Likely".
    • Other "Exploitation More Likely" flaws: CVE-2026-100214 (Dynamics Business Central RCE), CVE-2026-88159 (BITS RCE), CVE-2026-102217 (WebDAV EoP), CVE-2026-69918 (Core Messaging EoP), CVE-2026-96940 (Exchange EoP), and several EoP flaws in Windows Update, Desktop Window Manager, Windows AI and NetBIOS.
    • Products with the most CVEs: Microsoft Office Excel (69), DNS Server (52), Windows Kernel (46), Windows Installer (38), Win32 Kernel Subsystem (36).

    Remediation

    • Apply the October 2026 security updates as soon as possible. Prioritize CVE-2026-96951, the Exchange Server and Active Directory Domain Services flaws, and the "Exploitation More Likely" items.
    • Windows Server 2012 and 2012 R2 ESU ended on October 13, as did extended support for Windows 10 Enterprise 2016 LTSB and IoT Enterprise LTSB 2016. Tenable plugin IDs 192813, 182965 and 192817 can identify these systems.
    • Mainstream support for Windows Server 2022 ended on October 13. It now moves to extended support through October 14, 2031.
    • Also past end of support: Office 2021, Office LTSC 2021 (including Mac), Skype for Business LTSC 2021, and Windows 11 Home and Pro 24H2. Upgrade these to supported versions.