Update Windows: Record Patch Tuesday fixes flaw already under attack

CVE-2026-108398 is an untrusted search path flaw (CWE-426) in Microsoft .NET Framework. A locally authorized attacker can exploit it without user interaction to bypass a security feature, with changed scope and high impact to confidentiality, integrity, and availability (CVSS 3.1 base score 8.8). The issue is local only (AV:L, PR:L) and does not by itself grant remote access. It affects systems running the vulnerable .NET Framework builds; exact version ranges were not included in the source data. It is not listed in CISA KEV, and no public proof-of-concept is known; related October 2026 Patch Tuesday reporting describes other Microsoft flaws under attack, not this one.

Do: Install Microsoft's October 2026 security updates that cover .NET Framework on all supported Windows systems as soon as they are available for your release. Until patched, limit local logon rights to trusted accounts and avoid running untrusted binaries from writable directories that could sit earlier in the process search path. No public workaround specific to this CVE is documented in the source data.

MessagePack for C# before 2.5.303 and 3.1.9 can be driven into excessive memory use when PrimitiveObjectFormatter deserializes attacker-controlled MessagePack as System.Object. The formatter allocates an object array from each declared array length before the object-graph depth limit rejects the input, and nested array headers can reuse the same unread trailing bytes so a small payload keeps many large arrays alive at once. Repeated submissions can exhaust the managed heap, force heavy garbage collection, terminate the process, or deny service; there is no confidentiality or integrity impact. Only applications that deserialize untrusted MessagePack on this path are affected, such as a reachable ASP.NET Core SignalR hub method with an object parameter and AddMessagePackProtocol() enabled. There is no known public proof of concept and the issue is not listed in CISA KEV; fixes are in 2.5.303 and 3.1.9.

Do: Upgrade MessagePack for C# to 2.5.303 or 3.1.9 (or later on that line). Until then, do not deserialize untrusted MessagePack as System.Object through PrimitiveObjectFormatter; review ASP.NET Core SignalR hubs that use AddMessagePackProtocol() with object parameters, and limit message size and request rate on any endpoint that accepts attacker-controlled MessagePack.

CVE-2026-96951 is a command-injection flaw (CWE-77) in the Windows Shell in which special elements in a command are not properly neutralized. An unauthorized attacker can trigger it remotely with no prior privileges if a user interacts with attacker-controlled content, and Microsoft describes the result as bypassing a security feature; the CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) rates confidentiality, integrity, and availability impacts as high. Affected products named in the data are Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), Windows Server 2012 and 2016, and Outlook on the web. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-10-13, so exploitation in the wild is confirmed; ransomware use is listed as unknown and no public proof-of-concept is known.

Do: Apply Microsoft's security updates for every listed Windows and Outlook on the web build as soon as they are available, and follow CISA BOD 26-04 (including cloud guidance or discontinuation if a mitigation is unavailable). Prioritize internet-facing and high-value assets, and because exploitation needs user interaction, reinforce phishing-resistant handling of untrusted content while you patch.