.NET Framework (Product): news timeline & CVEs

October 2026 Patch Tuesday: 1,413 Flaws, 3 Zero-Days

Microsoft's October 2026 Patch Tuesday fixes 1,413 flaws, including an exploited Windows Shell zero-day.

Microsoft's October 13, 2026 Patch Tuesday fixes 1,413 vulnerabilities across Windows, Office, Exchange Server, SharePoint, .NET, Azure services, and developer tools. The total surpasses September's 974 flaws and is described as a second consecutive monthly record, which Microsoft has linked to AI-assisted vulnerability discovery. The release includes three zero-days and more than 70 critical-rated vulnerabilities. One zero-day is an exploited Windows Shell flaw, while the other two are publicly disclosed flaws in .NET Framework and a product cut off in the excerpt.

SOCRadarOct 14, 12:57 UTC · 2d agoVulnerability in the wild1

Update Windows: Record Patch Tuesday fixes flaw already under attack

Microsoft's October Patch Tuesday fixes 1,413 flaws, including an actively exploited Windows Shell zero-day.

Microsoft's October Patch Tuesday addresses a record 1,413 vulnerabilities, including the actively exploited Windows Shell flaw CVE-2026-96951 (CVSS 8.8). The bug bypasses Mark of the Web warnings but requires a user to open a crafted file or link. Two other flaws were publicly disclosed before patching: CVE-2026-108398 (CVSS 8.8), an untrusted .NET Framework search path that can bypass Windows Defender Application Control, and CVE-2026-92707 (CVSS 5.3), a MessagePack-CSharp issue that can let a remote attacker exhaust memory. Microsoft attributes the rising fix volume partly to greater use of AI in vulnerability discovery.

Malwarebytes LabsOct 14, 11:26 UTC · 2d agoExploit / PoC in the wildCVE-2026-96951 CVE-2026-108398 CVE-2026-927071· 1 read

Microsoft Patch Tuesday, October 2026 Security Update Review

Microsoft's October 2026 Patch Tuesday fixes 1,414 flaws, including exploited Windows Shell bypass CVE-2026-96951.

Qualys reviews Microsoft's October 2026 Patch Tuesday, its largest release, covering 1,414 vulnerabilities including 78 critical and 1,329 important issues. Two zero-days are patched; CVE-2026-96951, a Windows Shell security-feature bypass reachable over the network, is actively exploited and was added to CISA's Known Exploited Vulnerabilities catalog, with patching urged before October 16, 2026. CVE-2026-108398 is a local .NET Framework security-feature bypass. Critical fixes include unauthenticated remote code execution in Microsoft QUIC, Exchange Server, Windows Message Queuing, Media Foundation, and related Windows components.

Qualys ThreatPROTECTOct 14, 09:04 UTC · 2d agoVulnerability in the wildCVE-2026-96951 CVE-2026-108398 CVE-2026-105016+18 CVEs2· 1 read

Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug

Microsoft patched a record 1,413 flaws, including exploited Windows Shell bug CVE-2026-96951 now on CISA’s KEV list.

Microsoft’s October 2026 Patch Tuesday fixed 1,413 vulnerabilities, including 1,102 in Windows, 134 in Office, 36 in SharePoint Server, and 22 in SQL Server, with more than 70 rated Critical. CVE-2026-96951 (CVSS 8.8), a Windows Shell command-injection flaw that can bypass Mark of the Web, is exploited in the wild and is in CISA’s KEV catalog, with a federal deadline of October 16, 2026. Publicly known CVE-2026-108398 can bypass WDAC, while CVE-2026-92707 and non-Microsoft CVE-2026-21413 (CVSS 9.8) in Raw Image Extension, which can lead to remote code execution via thumbnails, were also patched. Tenable said Microsoft has patched more than 4,000 CVEs this year.

The Hacker Newsupdated Oct 16, 07:55 UTC · 19h agofirst Oct 14, 04:34 UTC · 2d agoExploit / PoC in the wild 6 sources

Microsoft Patches More Than 1,400 Security Flaws

Microsoft patched over 1,400 flaws, including an exploited Windows Shell bypass, CVE-2026-96951.

Microsoft released fixes for more than 1,400 vulnerabilities, far above September’s nearly 1,000 and the 1,261 patched in all of 2020. One issue, CVE-2026-96951, is a Windows Shell security-feature bypass affecting Windows 10, Windows 11, and some Server versions and is already exploited. At least 78 flaws are rated critical, mostly enabling code execution. CVE-2026-108398, a .NET Framework security-feature bypass, was publicly disclosed before the patches but has no observed exploitation. Tenable notes Microsoft has passed 4,000 CVEs this year, while only 26 Microsoft bugs have entered CISA’s KEV catalog so far.

Krebs on Securityupdated Oct 16, 07:55 UTC · 19h agofirst Oct 13, 23:24 UTC · 3d agoVulnerability in the wild 6 sources CVE-2026-96951 CVE-2026-108398

Zero-Days Lurk in Microsoft's Overgrown October Patch Tuesday

Microsoft's October 2026 Patch Tuesday fixes 1,413 CVEs, including an exploited Windows Shell zero-day.

Microsoft's October 2026 Patch Tuesday addresses 1,413 CVEs, including 80 critical flaws, exceeding September's 974. Two zero-days are security bypasses: actively exploited CVE-2026-96951 (CVSS 8.8) in Windows Shell, and CVE-2026-108398 in .NET Framework. Windows accounts for 1,102 flaws, with others affecting Office, developer tools, SharePoint, SQL Server, Exchange, Azure, and Defender. Microsoft also republished CVE-2026-21413, a Cisco Talos raw-image-extension remote code execution vulnerability. Fortra noted that 26 Microsoft CVEs from 2026 appear in CISA's Known Exploited Vulnerabilities catalog.

Dark ReadingOct 13, 22:29 UTC · 3d agoExploit / PoC in the wildCVE-2026-96951 CVE-2026-108398 CVE-2026-214131

Microsoft’s October 2026 Patch Tuesday addresses 1407 CVEs (CVE-2026-96951)

Microsoft’s October 2026 Patch Tuesday fixes 1,407 CVEs, including an exploited Windows Shell zero-day.

Microsoft’s October 2026 Patch Tuesday fixes 1,407 CVEs across 301 products, including 69 critical and 1,337 important issues, with elevation of privilege and remote code execution the largest categories. CVE-2026-96951, a Windows Shell Mark of the Web bypass scored 8.8, was exploited in the wild; CVE-2026-108398, a .NET Framework control bypass, was publicly disclosed. Critical bugs include Active Directory Domain Services RCE CVE-2026-70229 and Exchange RCE CVE-2026-70571, both rated exploitation more likely. Extended Security Updates for Windows Server 2012 and 2012 R2 ended on October 13.

Tenable BlogOct 13, 21:49 UTC · 3d agoVulnerability in the wildCVE-2026-96951 CVE-2026-21510 CVE-2026-32202+18 CVEs1

October 2026 Microsoft Patch Tuesday, (Tue, Oct 13th)

Microsoft's October 2026 Patch Tuesday patches 1,417 flaws, including an already exploited Windows Shell bypass.

Microsoft's October 2026 Patch Tuesday covers 1,417 vulnerabilities, including 76 rated critical and seven critical issues requiring no customer action. CVE-2026-96951, a Windows Shell security-feature bypass already exploited in the wild, can remove Mark of the Web from content sent by email or instant message, although the recipient must still open the file. CVE-2026-108398, a .NET application-control bypass, was disclosed before release but Microsoft has not seen exploitation. The release also includes 10 Windows DHCP Server remote-code-execution flaws, five critical, and Exchange CVE-2026-70571, a high-complexity RCE triggered when a crafted email is processed during content conversion.

SANS Internet Storm CenterOct 13, 19:25 UTC · 3d agoVulnerability in the wildCVE-2026-96951 CVE-2026-108398 CVE-2026-705711· 1 read

.NET Framework

Timeline8 articles

Related CVEsby mentions

Appears with