Microsoft October 2026 Patch Tuesday fixes record 1,411 CVEs, including one exploited Windows Shell zero-day
Microsoft released fixes for a record 1,411 CVEs in its October 2026 Patch Tuesday on October 13, more than the roughly 1,100 issued in all of 2025 and above the records set in July and September. The surge is attributed to Microsoft's use of AI-driven vulnerability discovery, including its multi-model agentic scanning harness (MDASH). The release includes one actively exploited zero-day, CVE-2026-96951, a Windows Shell security feature bypass, and two publicly disclosed zero-days. Of 70 critical flaws, 57 are remote code execution bugs, including CVE-2026-70242, a CVSS 9.8 Outlook Reading Pane RCE. Socura research found that 22% of UK CISOs have called in sick or booked leave to avoid Patch Tuesday.
Technical Details
- CVE-2026-96951 (Windows Shell security feature bypass, CVSS 8.8): actively exploited, low complexity, no privileges required. Attackers deliver crafted files via phishing emails, instant messages or malicious websites, and user interaction triggers exploitation. It can suppress expected security warnings and serve as an initial entry point.
- CVE-2026-108398 (.NET Framework security feature bypass, CVSS 8.8): publicly disclosed. An authenticated, low-privileged local attacker can bypass Windows Defender Application Control (WDAC) through an untrusted assembly search path. There is no workaround and Microsoft rates it "exploitation more likely".
- CVE-2026-92707 (MessagePack-CSharp denial of service): publicly disclosed. Improperly controlled sequential memory allocation in .NET lets an unauthorized attacker deny service over a network.
- CVE-2026-70242 (Outlook Reading Pane RCE, CVSS 9.8): a crafted email triggers a heap-based buffer overflow when previewed, with no authentication or user interaction needed. The article does not state it is exploited.
Remediation
- Apply the October 2026 security updates without delay, prioritizing CVE-2026-96951, CVE-2026-108398 and CVE-2026-70242.
- Reinforce user awareness of malicious files delivered via email, chat and web links.
Linha do tempo
-
Microsoft October 2026 Patch Tuesday fixes record 1,411 CVEs, including one exploited Windows Shell zero-day
ler a análise desta fonte ocultar
Microsoft released fixes for a record 1,411 CVEs in its October 2026 Patch Tuesday on October 13, more than the roughly 1,100 issued in all of 2025 and above the records set in July and September. The surge is attributed to Microsoft's use of AI-driven vulnerability discovery, including its multi-model agentic scanning harness (MDASH). The release includes one actively exploited zero-day, CVE-2026-96951, a Windows Shell security feature bypass, and two publicly disclosed zero-days. Of 70 critical flaws, 57 are remote code execution bugs, including CVE-2026-70242, a CVSS 9.8 Outlook Reading Pane RCE. Socura research found that 22% of UK CISOs have called in sick or booked leave to avoid Patch Tuesday.
Technical Details
- CVE-2026-96951 (Windows Shell security feature bypass, CVSS 8.8): actively exploited, low complexity, no privileges required. Attackers deliver crafted files via phishing emails, instant messages or malicious websites, and user interaction triggers exploitation. It can suppress expected security warnings and serve as an initial entry point.
- CVE-2026-108398 (.NET Framework security feature bypass, CVSS 8.8): publicly disclosed. An authenticated, low-privileged local attacker can bypass Windows Defender Application Control (WDAC) through an untrusted assembly search path. There is no workaround and Microsoft rates it "exploitation more likely".
- CVE-2026-92707 (MessagePack-CSharp denial of service): publicly disclosed. Improperly controlled sequential memory allocation in .NET lets an unauthorized attacker deny service over a network.
- CVE-2026-70242 (Outlook Reading Pane RCE, CVSS 9.8): a crafted email triggers a heap-based buffer overflow when previewed, with no authentication or user interaction needed. The article does not state it is exploited.
Remediation
- Apply the October 2026 security updates without delay, prioritizing CVE-2026-96951, CVE-2026-108398 and CVE-2026-70242.
- Reinforce user awareness of malicious files delivered via email, chat and web links.