Microsoft security advisory – October 2026 monthly rollup (AV26-1038)
Canada's Cyber Centre urges patching Microsoft's October 2026 updates after exploited CVE-2026-96951 entered CISA's KEV.
The Canadian Centre for Cyber Security issued advisory AV26-1038 on Microsoft's October 13, 2026 monthly security rollup, listing vulnerabilities across Windows, Office, Exchange, SharePoint, SQL Server, .NET, Azure, and many other products. Microsoft indicated that CVE-2026-96951 has been exploited, and CISA added it to the Known Exploited Vulnerabilities catalog the same day. The Cyber Centre urges administrators to review Microsoft's updates and apply the available patches and mitigations.
- Canadian Cyber Centre advisory AV26-1038 covers Microsoft's October 13, 2026 updates.
- Affected products span Windows, Office, Exchange, SharePoint, SQL Server, .NET, and Azure.
- Microsoft says CVE-2026-96951 has been exploited.
- CISA added CVE-2026-96951 to the Known Exploited Vulnerabilities catalog.
Vulnerabilities mentionedAll →
- CVE-2026-969518.82%Windows Shell command injection bypasses a security featurepublished · Microsoft Windows 10 KEV
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-96951 | Windows Shell command injection bypasses a security feature CVE-2026-96951 is a command-injection flaw (CWE-77) in the Windows Shell in which special elements in a command are not properly neutralized. An unauthorized attacker can trigger it remotely with no prior privileges if a user interacts with attacker-controlled content, and Microsoft describes the result as bypassing a security feature; the CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) rates confidentiality, integrity, and availability impacts as high. Affected products named in the data are Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), Windows Server 2012 and 2016, and Outlook on the web. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-10-13, so exploitation in the wild is confirmed; ransomware use is listed as unknown and no public proof-of-concept is known. |
Full article339 words · extracted from cyber.gc.ca · click to collapse
Serial Number:AV26-1038
Date: October 13, 2026
As of October 13, 2026, Microsoft is affected by vulnerabilities in the following products:
- .NET 10.0
- .NET 11.0
- .NET 8.0
- .NET 9.0
- ASP.NET Core 10.0
- ASP.NET Core 11.0
- ASP.NET Core 8.0
- ASP.NET Core 9.0
- Arc Enabled Servers
- Azure API Center
- Azure App Service for Linux
- Azure CLI
- Azure CycleCloud
- Azure Container Storage enabled by Azure Arc
- Azure Event Grid System
- Azure SRE Agent
- Azure Storage Blobs client library for Java
- HVEC Video Extensions
- Microsoft .NET Framework 3.5 AND 4.8.1
- Microsoft .NET Framework 4.8.1
- Microsoft 365 Apps for Enterprise
- Microsoft Bookings
- Microsoft Configuration Manager 2503
- Microsoft Configuration Manager 2509
- Microsoft Configuration Manager 2603
- Microsoft Defender for Endpoint
- Microsoft Dataverse
- Microsoft Dynamics 365 (on-premises) version 9.1
- Microsoft Dynamics NAV 2017
- Microsoft Dynamics NAV 2018
- Microsoft Exchange Server 2016
- Microsoft Exchange Server 2019
- Microsoft Exchange Server Subscription Edition RTM
- Microsoft Office 365
- Microsoft Office LTSC 2021
- Microsoft Office LTSC 2024
- Microsoft Office Online Server
- Microsoft Outlook
- Microsoft Paint
- Microsoft Partner Center
- Microsoft Power Apps
- Microsoft PowerToys
- Microsoft SQL Server 2017
- Microsoft SQL Server 2019
- Microsoft SQL Server 2022
- Microsoft SQL Server 2025
- Microsoft SharePoint Enterprise Server 2016
- Microsoft SharePoint Server 2019
- Microsoft SharePoint Server Subscription Edition
- Microsoft Visual Studio 2022
- Microsoft Visual Studio 2026
- PowerShell 7.4
- PowerShell 7.5
- PowerShell 7.6
- Raw Image Extension on Windows 10
- Raw Image Extension on Windows 11
- Skype for Business Server 2015
- Skype for Business Server 2019
- Skype for Business Server Subscription Edition CU1
- Skype for Business Server Subscription Edition RTM
- Sysinternals Suite
- Visual Studio Code
- Windows 10
- Windows 11
- Windows Defender
- Windows Security App
- Windows Server 2012
- Windows Server 2012 R2
- Windows Server 2016
- Windows Server 2019
- Windows Server 2022
- Windows Server 2025
Microsoft has indicated that CVE-2026-96951 has been exploited.
On October 13, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-96951 to their Known Exploited Vulnerabilities (KEV) Database.
The Cyber Centre encourages users and administrators to review the web link provided, perform the suggested mitigations, and apply the necessary updates.