CVE-2026-108398: Untrusted search path in Microsoft .NET Framework

Update Windows: Record Patch Tuesday fixes flaw already under attack

Microsoft's October Patch Tuesday fixes 1,413 flaws, including an actively exploited Windows Shell zero-day.

Microsoft's October Patch Tuesday addresses a record 1,413 vulnerabilities, including the actively exploited Windows Shell flaw CVE-2026-96951 (CVSS 8.8). The bug bypasses Mark of the Web warnings but requires a user to open a crafted file or link. Two other flaws were publicly disclosed before patching: CVE-2026-108398 (CVSS 8.8), an untrusted .NET Framework search path that can bypass Windows Defender Application Control, and CVE-2026-92707 (CVSS 5.3), a MessagePack-CSharp issue that can let a remote attacker exhaust memory. Microsoft attributes the rising fix volume partly to greater use of AI in vulnerability discovery.

Malwarebytes LabsOct 14, 11:26 UTC · 2d agoExploit / PoC in the wildCVE-2026-96951 CVE-2026-108398 CVE-2026-927071· 1 read

Zero-Days Lurk in Microsoft's Overgrown October Patch Tuesday

Microsoft's October 2026 Patch Tuesday fixes 1,413 CVEs, including an exploited Windows Shell zero-day.

Microsoft's October 2026 Patch Tuesday addresses 1,413 CVEs, including 80 critical flaws, exceeding September's 974. Two zero-days are security bypasses: actively exploited CVE-2026-96951 (CVSS 8.8) in Windows Shell, and CVE-2026-108398 in .NET Framework. Windows accounts for 1,102 flaws, with others affecting Office, developer tools, SharePoint, SQL Server, Exchange, Azure, and Defender. Microsoft also republished CVE-2026-21413, a Cisco Talos raw-image-extension remote code execution vulnerability. Fortra noted that 26 Microsoft CVEs from 2026 appear in CISA's Known Exploited Vulnerabilities catalog.

Dark ReadingOct 13, 22:29 UTC · 3d agoExploit / PoC in the wildCVE-2026-96951 CVE-2026-108398 CVE-2026-214131

Microsoft Patch Tuesday, October 2026 Security Update Review

Microsoft's October 2026 Patch Tuesday fixes 1,414 flaws, including exploited Windows Shell bypass CVE-2026-96951.

Qualys reviews Microsoft's October 2026 Patch Tuesday, its largest release, covering 1,414 vulnerabilities including 78 critical and 1,329 important issues. Two zero-days are patched; CVE-2026-96951, a Windows Shell security-feature bypass reachable over the network, is actively exploited and was added to CISA's Known Exploited Vulnerabilities catalog, with patching urged before October 16, 2026. CVE-2026-108398 is a local .NET Framework security-feature bypass. Critical fixes include unauthenticated remote code execution in Microsoft QUIC, Exchange Server, Windows Message Queuing, Media Foundation, and related Windows components.

Qualys ThreatPROTECTOct 14, 09:04 UTC · 2d agoVulnerability in the wildCVE-2026-96951 CVE-2026-108398 CVE-2026-105016+18 CVEs2· 1 read

Microsoft Breaks Patch Tuesday Record Again with 1400+ CVEs

Microsoft's October 2026 Patch Tuesday fixes 1,411 CVEs, including one actively exploited Windows Shell bypass.

Microsoft's October 13, 2026 Patch Tuesday fixed 1,411 CVEs, more than the just over 1,100 updates released in all of 2025, which the company has tied to AI-assisted discovery including its MDASH scanning harness. One flaw, CVE-2026-96951, a Windows Shell security-feature bypass scored CVSS 8.8, is actively exploited and can be triggered by a user opening a crafted file from email, chat, or a website. Two publicly disclosed but not yet exploited issues are CVE-2026-108398, a .NET bypass of Windows Defender Application Control, and CVE-2026-92707, a network denial of service in MessagePack-CSharp. Of 70 critical bugs, 57 are remote code execution, including Outlook Reading Pane flaw CVE-2026-70242 at CVSS 9.8, which can trigger from preview alone.

Infosecurity MagazineOct 14, 08:45 UTC · 2d agoVulnerability in the wildCVE-2026-96951 CVE-2026-108398 CVE-2026-92707+1 CVEs1

Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug

Microsoft patched a record 1,413 flaws, including exploited Windows Shell bug CVE-2026-96951 now on CISA’s KEV list.

Microsoft’s October 2026 Patch Tuesday fixed 1,413 vulnerabilities, including 1,102 in Windows, 134 in Office, 36 in SharePoint Server, and 22 in SQL Server, with more than 70 rated Critical. CVE-2026-96951 (CVSS 8.8), a Windows Shell command-injection flaw that can bypass Mark of the Web, is exploited in the wild and is in CISA’s KEV catalog, with a federal deadline of October 16, 2026. Publicly known CVE-2026-108398 can bypass WDAC, while CVE-2026-92707 and non-Microsoft CVE-2026-21413 (CVSS 9.8) in Raw Image Extension, which can lead to remote code execution via thumbnails, were also patched. Tenable said Microsoft has patched more than 4,000 CVEs this year.

The Hacker NewsOct 14, 04:34 UTC · 2d agoExploit / PoC in the wildCVE-2026-96951 CVE-2026-108398 CVE-2026-92707+1 CVEs2· 1 read

October Patch Tuesday roundup: Over 1,400 Microsoft holes to be plugged, including three zero days

Microsoft's October Patch Tuesday fixes 1,407 CVEs, including an exploited Windows Shell Mark-of-the-Web bypass.

Microsoft's October 2026 Patch Tuesday covers a record 1,407 CVEs, including three zero-days. Exploited CVE-2026-96951 bypasses Windows Shell Mark of the Web; SharePoint CVE-2026-102866 can hijack accounts via token validation, and CVE-2026-108398 can bypass Windows Defender Application Control. Separately, self-managed GitLab CVE-2026-97229, IBM i CVE-2026-96119 (CVSS 9.9), and Atlassian CVE-2026-21589—with exploitation attempts reported from October 6—require urgent patching. Researchers also flagged 55 wormable Microsoft CVEs and four high-severity on-premises Exchange fixes.

CSO OnlineOct 14, 02:29 UTC · 3d agoVulnerability in the wildCVE-2026-96951 CVE-2026-21510 CVE-2026-32202+5 CVEs2

Microsoft’s October 2026 Patch Tuesday addresses 1407 CVEs (CVE-2026-96951)

Microsoft’s October 2026 Patch Tuesday fixes 1,407 CVEs, including an exploited Windows Shell zero-day.

Microsoft’s October 2026 Patch Tuesday fixes 1,407 CVEs across 301 products, including 69 critical and 1,337 important issues, with elevation of privilege and remote code execution the largest categories. CVE-2026-96951, a Windows Shell Mark of the Web bypass scored 8.8, was exploited in the wild; CVE-2026-108398, a .NET Framework control bypass, was publicly disclosed. Critical bugs include Active Directory Domain Services RCE CVE-2026-70229 and Exchange RCE CVE-2026-70571, both rated exploitation more likely. Extended Security Updates for Windows Server 2012 and 2012 R2 ended on October 13.

Tenable BlogOct 13, 21:49 UTC · 3d agoVulnerability in the wildCVE-2026-96951 CVE-2026-21510 CVE-2026-32202+18 CVEs1

October 2026 Microsoft Patch Tuesday, (Tue, Oct 13th)

Microsoft's October 2026 Patch Tuesday patches 1,417 flaws, including an already exploited Windows Shell bypass.

Microsoft's October 2026 Patch Tuesday covers 1,417 vulnerabilities, including 76 rated critical and seven critical issues requiring no customer action. CVE-2026-96951, a Windows Shell security-feature bypass already exploited in the wild, can remove Mark of the Web from content sent by email or instant message, although the recipient must still open the file. CVE-2026-108398, a .NET application-control bypass, was disclosed before release but Microsoft has not seen exploitation. The release also includes 10 Windows DHCP Server remote-code-execution flaws, five critical, and Exchange CVE-2026-70571, a high-complexity RCE triggered when a crafted email is processed during content conversion.

SANS Internet Storm CenterOct 13, 19:25 UTC · 3d agoVulnerability in the wildCVE-2026-96951 CVE-2026-108398 CVE-2026-705711· 1 read

Microsoft Patches More Than 1,400 Security Flaws

Microsoft patched over 1,400 flaws, including an exploited Windows Shell bypass, CVE-2026-96951.

Microsoft released fixes for more than 1,400 vulnerabilities, far above September’s nearly 1,000 and the 1,261 patched in all of 2020. One issue, CVE-2026-96951, is a Windows Shell security-feature bypass affecting Windows 10, Windows 11, and some Server versions and is already exploited. At least 78 flaws are rated critical, mostly enabling code execution. CVE-2026-108398, a .NET Framework security-feature bypass, was publicly disclosed before the patches but has no observed exploitation. Tenable notes Microsoft has passed 4,000 CVEs this year, while only 26 Microsoft bugs have entered CISA’s KEV catalog so far.

Krebs on SecurityOct 13, 23:24 UTC · 3d agoVulnerability in the wildCVE-2026-96951 CVE-2026-1083981· 1 read

The October 2026 Security Update Review

ZDI's October 2026 review lists dozens of critical Microsoft Office, Azure, Exchange, and Windows flaws.

The Zero Day Initiative's October 2026 Security Update Review catalogs a large Microsoft patch set spanning Windows, Office, Exchange, Azure, Active Directory, and related components. Many entries are rated Critical, including remote code execution in Outlook, Excel, PowerPoint, Word, Exchange, Azure App Service, Dataverse, QUIC, and printer drivers, with several CVSS scores of 9.8. Microsoft Partner Center elevation of privilege is listed at CVSS 10.0 and Microsoft Bookings elevation at 9.9. The visible entries are mostly marked not exploited in the supplied flags, and the text does not explicitly confirm active exploitation.

Zero Day Initiative BlogOct 13, 19:34 UTC · 3d agoVulnerability CVE-2026-100209 CVE-2026-100210 CVE-2026-100211+27 CVEs2

CVE-2026-108398

In the news10 stories