Windows Shell (Product): news timeline & CVEs

Microsoft drops an actively exploited zero-day among record high of 1,413 vulnerabilities

Microsoft's October Patch Tuesday fixes 1,413 flaws, including exploited Windows Shell bypass CVE-2026-96951.

Microsoft's October 2026 Patch Tuesday addresses 1,413 vulnerabilities, more than its previous annual record of 1,261 CVEs in 2020. About 1,102 affect Windows, with 134 in Office, 61 in developer tools, and 36 in SharePoint Server. One high-severity Windows Shell flaw, CVE-2026-96951, is actively exploited to bypass a security feature and is the third Windows Shell bug exploited in 2026. Microsoft also introduced risk cohorts to help customers prioritize the unusually large update.

CyberScoopupdated Oct 16, 07:55 UTC · 19h agofirst Oct 14, 17:42 UTC · 2d agoExploit / PoC in the wild 6 sources CVE-2026-969513· 1 read

October 2026 Patch Tuesday: 1,413 Flaws, 3 Zero-Days

Microsoft's October 2026 Patch Tuesday fixes 1,413 flaws, including an exploited Windows Shell zero-day.

Microsoft's October 13, 2026 Patch Tuesday fixes 1,413 vulnerabilities across Windows, Office, Exchange Server, SharePoint, .NET, Azure services, and developer tools. The total surpasses September's 974 flaws and is described as a second consecutive monthly record, which Microsoft has linked to AI-assisted vulnerability discovery. The release includes three zero-days and more than 70 critical-rated vulnerabilities. One zero-day is an exploited Windows Shell flaw, while the other two are publicly disclosed flaws in .NET Framework and a product cut off in the excerpt.

SOCRadarOct 14, 12:57 UTC · 2d agoVulnerability in the wild1

Update Windows: Record Patch Tuesday fixes flaw already under attack

Microsoft's October Patch Tuesday fixes 1,413 flaws, including an actively exploited Windows Shell zero-day.

Microsoft's October Patch Tuesday addresses a record 1,413 vulnerabilities, including the actively exploited Windows Shell flaw CVE-2026-96951 (CVSS 8.8). The bug bypasses Mark of the Web warnings but requires a user to open a crafted file or link. Two other flaws were publicly disclosed before patching: CVE-2026-108398 (CVSS 8.8), an untrusted .NET Framework search path that can bypass Windows Defender Application Control, and CVE-2026-92707 (CVSS 5.3), a MessagePack-CSharp issue that can let a remote attacker exhaust memory. Microsoft attributes the rising fix volume partly to greater use of AI in vulnerability discovery.

Malwarebytes LabsOct 14, 11:26 UTC · 2d agoExploit / PoC in the wildCVE-2026-96951 CVE-2026-108398 CVE-2026-927071· 1 read

Microsoft Patch Tuesday, October 2026 Security Update Review

Microsoft's October 2026 Patch Tuesday fixes 1,414 flaws, including exploited Windows Shell bypass CVE-2026-96951.

Qualys reviews Microsoft's October 2026 Patch Tuesday, its largest release, covering 1,414 vulnerabilities including 78 critical and 1,329 important issues. Two zero-days are patched; CVE-2026-96951, a Windows Shell security-feature bypass reachable over the network, is actively exploited and was added to CISA's Known Exploited Vulnerabilities catalog, with patching urged before October 16, 2026. CVE-2026-108398 is a local .NET Framework security-feature bypass. Critical fixes include unauthenticated remote code execution in Microsoft QUIC, Exchange Server, Windows Message Queuing, Media Foundation, and related Windows components.

Qualys ThreatPROTECTOct 14, 09:04 UTC · 2d agoVulnerability in the wildCVE-2026-96951 CVE-2026-108398 CVE-2026-105016+18 CVEs2· 1 read

Microsoft Breaks Patch Tuesday Record Again with 1400+ CVEs

Microsoft's October 2026 Patch Tuesday fixes 1,411 CVEs, including one actively exploited Windows Shell bypass.

Microsoft's October 13, 2026 Patch Tuesday fixed 1,411 CVEs, more than the just over 1,100 updates released in all of 2025, which the company has tied to AI-assisted discovery including its MDASH scanning harness. One flaw, CVE-2026-96951, a Windows Shell security-feature bypass scored CVSS 8.8, is actively exploited and can be triggered by a user opening a crafted file from email, chat, or a website. Two publicly disclosed but not yet exploited issues are CVE-2026-108398, a .NET bypass of Windows Defender Application Control, and CVE-2026-92707, a network denial of service in MessagePack-CSharp. Of 70 critical bugs, 57 are remote code execution, including Outlook Reading Pane flaw CVE-2026-70242 at CVSS 9.8, which can trigger from preview alone.

Infosecurity MagazineOct 14, 08:45 UTC · 2d agoVulnerability in the wildCVE-2026-96951 CVE-2026-108398 CVE-2026-92707+1 CVEs1

October Patch Tuesday roundup: Over 1,400 Microsoft holes to be plugged, including three zero days

Microsoft's October Patch Tuesday fixes 1,407 CVEs, including an exploited Windows Shell Mark-of-the-Web bypass.

Microsoft's October 2026 Patch Tuesday covers a record 1,407 CVEs, including three zero-days. Exploited CVE-2026-96951 bypasses Windows Shell Mark of the Web; SharePoint CVE-2026-102866 can hijack accounts via token validation, and CVE-2026-108398 can bypass Windows Defender Application Control. Separately, self-managed GitLab CVE-2026-97229, IBM i CVE-2026-96119 (CVSS 9.9), and Atlassian CVE-2026-21589—with exploitation attempts reported from October 6—require urgent patching. Researchers also flagged 55 wormable Microsoft CVEs and four high-severity on-premises Exchange fixes.

CSO OnlineOct 14, 02:29 UTC · 3d agoVulnerability in the wildCVE-2026-96951 CVE-2026-21510 CVE-2026-32202+5 CVEs2

Microsoft Patches More Than 1,400 Security Flaws

Microsoft patched over 1,400 flaws, including an exploited Windows Shell bypass, CVE-2026-96951.

Microsoft released fixes for more than 1,400 vulnerabilities, far above September’s nearly 1,000 and the 1,261 patched in all of 2020. One issue, CVE-2026-96951, is a Windows Shell security-feature bypass affecting Windows 10, Windows 11, and some Server versions and is already exploited. At least 78 flaws are rated critical, mostly enabling code execution. CVE-2026-108398, a .NET Framework security-feature bypass, was publicly disclosed before the patches but has no observed exploitation. Tenable notes Microsoft has passed 4,000 CVEs this year, while only 26 Microsoft bugs have entered CISA’s KEV catalog so far.

Krebs on Securityupdated Oct 16, 07:55 UTC · 19h agofirst Oct 13, 23:24 UTC · 3d agoVulnerability in the wild 6 sources CVE-2026-96951 CVE-2026-108398

Zero-Days Lurk in Microsoft's Overgrown October Patch Tuesday

Microsoft's October 2026 Patch Tuesday fixes 1,413 CVEs, including an exploited Windows Shell zero-day.

Microsoft's October 2026 Patch Tuesday addresses 1,413 CVEs, including 80 critical flaws, exceeding September's 974. Two zero-days are security bypasses: actively exploited CVE-2026-96951 (CVSS 8.8) in Windows Shell, and CVE-2026-108398 in .NET Framework. Windows accounts for 1,102 flaws, with others affecting Office, developer tools, SharePoint, SQL Server, Exchange, Azure, and Defender. Microsoft also republished CVE-2026-21413, a Cisco Talos raw-image-extension remote code execution vulnerability. Fortra noted that 26 Microsoft CVEs from 2026 appear in CISA's Known Exploited Vulnerabilities catalog.

Dark ReadingOct 13, 22:29 UTC · 3d agoExploit / PoC in the wildCVE-2026-96951 CVE-2026-108398 CVE-2026-214131

Microsoft’s October 2026 Patch Tuesday addresses 1407 CVEs (CVE-2026-96951)

Microsoft’s October 2026 Patch Tuesday fixes 1,407 CVEs, including an exploited Windows Shell zero-day.

Microsoft’s October 2026 Patch Tuesday fixes 1,407 CVEs across 301 products, including 69 critical and 1,337 important issues, with elevation of privilege and remote code execution the largest categories. CVE-2026-96951, a Windows Shell Mark of the Web bypass scored 8.8, was exploited in the wild; CVE-2026-108398, a .NET Framework control bypass, was publicly disclosed. Critical bugs include Active Directory Domain Services RCE CVE-2026-70229 and Exchange RCE CVE-2026-70571, both rated exploitation more likely. Extended Security Updates for Windows Server 2012 and 2012 R2 ended on October 13.

Tenable BlogOct 13, 21:49 UTC · 3d agoVulnerability in the wildCVE-2026-96951 CVE-2026-21510 CVE-2026-32202+18 CVEs1

Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities

Microsoft's October 2026 Patch Tuesday fixes 1,415 flaws, including 85 critical, with one Windows Shell bug exploited in the wild.

Microsoft's October 2026 Patch Tuesday addresses 1,415 vulnerabilities, 85 of them critical, across Windows, Office, Exchange, Hyper-V, and other products. Cisco Talos says CVE-2026-96951, a Windows Shell command-injection flaw scored 8.8, is already exploited. Sixty-seven critical bugs allow remote code execution, including CVSS 9.8 issues in Message Queuing, Microsoft QUIC, Text Shaping, and the PostScript printer driver. Microsoft rates Active Directory CVE-2026-70229 and Exchange CVE-2026-70571 as more likely to be exploited.

Cisco TalosOct 13, 20:37 UTC · 3d agoVulnerability in the wildCVE-2026-96951 CVE-2026-70229 CVE-2026-70571+27 CVEs

October 2026 Microsoft Patch Tuesday, (Tue, Oct 13th)

Microsoft's October 2026 Patch Tuesday patches 1,417 flaws, including an already exploited Windows Shell bypass.

Microsoft's October 2026 Patch Tuesday covers 1,417 vulnerabilities, including 76 rated critical and seven critical issues requiring no customer action. CVE-2026-96951, a Windows Shell security-feature bypass already exploited in the wild, can remove Mark of the Web from content sent by email or instant message, although the recipient must still open the file. CVE-2026-108398, a .NET application-control bypass, was disclosed before release but Microsoft has not seen exploitation. The release also includes 10 Windows DHCP Server remote-code-execution flaws, five critical, and Exchange CVE-2026-70571, a high-complexity RCE triggered when a crafted email is processed during content conversion.

SANS Internet Storm CenterOct 13, 19:25 UTC · 3d agoVulnerability in the wildCVE-2026-96951 CVE-2026-108398 CVE-2026-705711· 1 read

Windows Shell

Timeline11 articles

Related CVEsby mentions

Appears with