Story · 6 sources · 6 articlesfirst Oct 13, 23:24 UTCupdated Oct 16, 07:55 UTC (19h ago)

Microsoft October patches fix record flaws and later Office bugs

highExploit / PoCexploited in the wildimportance 84CVE-2026-96951 CVE-2026-108398 CVE-2026-92707 CVE-2026-21413 CVE-2026-104935

What's new: SecurityWeek's October 16 report adds a later batch of more than 30 newly disclosed flaws, about two dozen unexploited high-severity Office remote-code-execution bugs (roughly six via the Preview Pane), plus ASP.NET Core, Identity Web, MSAL for Node.js, and Mac Office updates.

Merged summary · grok-4.7-build · rewritten as coverage arrives

Microsoft's October 2026 updates fix a disputed record of about 1,413 flaws, including exploited Windows Shell bypass CVE-2026-96951, plus later unexploited Office bugs.

Microsoft's October 13, 2026 Patch Tuesday addressed a record monthly volume of vulnerabilities. The Hacker News and CyberScoop both report 1,413 fixes, above the 1,261 patched in all of 2020 and September's nearly 1,000, while Krebs said more than 1,400 and Security Affairs reported 1,415. Cited breakdowns include 1,102 Windows flaws, 134 in Office, and 36 in SharePoint, with CyberScoop adding 61 developer-tool issues and The Hacker News adding 22 in SQL Server. The exploited issue is CVE-2026-96951 (CVSS 8.8), a Windows Shell command-injection flaw that can bypass Mark of the Web when a user opens a crafted link or file; CISA added it to the KEV catalog with a federal deadline of October 16, 2026, and Canada's Cyber Centre urged patching in advisory AV26-1038. Sources disagree on critical counts—at least 78 versus more than 70—and also note unexploited .NET/WDAC bypass CVE-2026-108398, patched CVE-2026-92707 and Raw Image Extension CVE-2026-21413 (CVSS 9.8), more than 4,000 Microsoft CVEs this year with only 26 in CISA's KEV, new Microsoft risk cohorts, and a separate KEV listing for Ivanti Connect Secure CVE-2026-104935. On October 16, SecurityWeek reported a further set of more than 30 newly disclosed Microsoft flaws, including about two dozen high-severity Office remote-code-execution bugs—roughly six reachable through the Preview Pane—that Microsoft said were not exploited, along with fixes for ASP.NET Core, Identity Web, MSAL for Node.js, and Mac Office releases.

Microsoft's October 13, 2026 Patch Tuesday fixed a record monthly set: The Hacker News and CyberScoop say 1,413, Krebs more than 1,400, and Security Affairs 1,415, above 1,261 in all of 2020 and September's nearly 1,000.
Cited splits include 1,102 Windows, 134 Office, and 36 SharePoint flaws, plus 22 SQL Server issues (The Hacker News) and 61 developer-tool flaws (CyberScoop).
CVE-2026-96951 (CVSS 8.8) is an exploited Windows Shell command-injection flaw that can bypass Mark of the Web; CISA's KEV deadline for federal agencies is October 16, 2026, and Canada issued advisory AV26-1038.
Critical totals disagree: at least 78 (Krebs) versus more than 70 (The Hacker News). CyberScoop says CVE-2026-96951 is this month's only actively exploited bug and the third Windows Shell bug exploited in 2026.
Also noted: unexploited .NET/WDAC bypass CVE-2026-108398, patched CVE-2026-92707, non-Microsoft Raw Image Extension CVE-2026-21413 (CVSS 9.8), more than 4,000 Microsoft CVEs this year, and only 26 Microsoft bugs in CISA's KEV so far…

VendorsMicrosoft Ivanti

ProductsWindows Windows Shell Microsoft Office SharePoint Server SQL Server .NET Framework Windows Defender Application Control Raw Image Extension Ivanti Connect Secure Windows 10 Windows 11 Microsoft Word

OrganizationsTrendAI Zero Day Initiative Tenable Microsoft CISA Google Project Zero Rapid7

Coverage timelineoldest first · each row is one article

Oct 13, 23:24 UTC · 3d ago
Krebs on Security· 80
Microsoft Patches More Than 1,400 Security Flaws
Microsoft patched over 1,400 flaws, including an exploited Windows Shell bypass, CVE-2026-96951.
Oct 14, 04:34 UTC · 2d ago
The Hacker News· 84
Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug
Microsoft patched a record 1,413 flaws, including exploited Windows Shell bug CVE-2026-96951 now on CISA’s KEV list.
Oct 14, 15:36 UTC · 2d ago
Canadian Centre for Cyber Security· 74
Microsoft security advisory – October 2026 monthly rollup (AV26-1038)

Vulnerabilities in this storyAll →

CVE-2026-1049358.626%
Auth Bypass to Command Execution in Ivanti Connect Secure
published 3d ago· Ivanti Connect Secure KEV PoC ×2
CVE-2026-108398

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-104935	Auth Bypass to Command Execution in Ivanti Connect Secure CVE-2026-104935 is an authentication bypass by spoofing (CWE-290) in Ivanti Connect Secure. A remote, unauthenticated attacker can spoof authentication on affected gateways and then execute arbitrary commands. Impact is high confidentiality loss with lower integrity and availability impact (CVSS 3.1 base 8.6; network, low complexity, no privileges or user interaction). It affects Connect Secure builds before 25.1.3.0 and does not affect 22.7R2.14 or earlier. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-10-13 after reported zero-day attacks; ransomware use is listed as unknown, public proof-of-concept references exist, and EPSS is about 26% (98th percentile). Do: Upgrade Ivanti Connect Secure to 25.1.3.0 or later. Builds at 22.7R2.14 and earlier are not affected. Because this is in CISA’s KEV catalog, apply the vendor’s mitigations, follow BOD 26-04 and CISA forensics-triage guidance, and treat internet-exposed appliances as potentially compromised until reviewed.	8.6	26%	KEV PoC ×2	Ivanti Connect Secure versions before 25.1.3.0, excluding 22.7R2.14 and earlier	largeon the order of 10,000–50,000 internet-exposed gateways for the product line; vulnerable-version subset unknown	3d ago KEV Oct 13, 2026
CVE-2026-108398	Untrusted search path in Microsoft .NET Framework CVE-2026-108398 is an untrusted search path flaw (CWE-426) in Microsoft .NET Framework. A locally authorized attacker can exploit it without user interaction to bypass a security feature, with changed scope and high impact to confidentiality, integrity, and availability (CVSS 3.1 base score 8.8). The issue is local only (AV:L, PR:L) and does not by itself grant remote access. It affects systems running the vulnerable .NET Framework builds; exact version ranges were not included in the source data. It is not listed in CISA KEV, and no public proof-of-concept is known; related October 2026 Patch Tuesday reporting describes other Microsoft flaws under attack, not this one. Do: Install Microsoft's October 2026 security updates that cover .NET Framework on all supported Windows systems as soon as they are available for your release. Until patched, limit local logon rights to trusted accounts and avoid running untrusted binaries from writable directories that could sit earlier in the process search path. No public workaround specific to this CVE is documented in the source data.	8.8	—		Microsoft .NET Framework	massHundreds of millions of Windows installations that include .NET Framework (order-of-magnitude estimate)	3d ago
CVE-2026-21413	A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545 and Commit d20315b A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability. NVD description · AI analysis pending	9.8	<1%	PoC ×2	libraw libraw	—	Apr 7, 2026
CVE-2026-92707	Memory-exhaustion DoS in MessagePack for C# MessagePack for C# before 2.5.303 and 3.1.9 can be driven into excessive memory use when PrimitiveObjectFormatter deserializes attacker-controlled MessagePack as System.Object. The formatter allocates an object array from each declared array length before the object-graph depth limit rejects the input, and nested array headers can reuse the same unread trailing bytes so a small payload keeps many large arrays alive at once. Repeated submissions can exhaust the managed heap, force heavy garbage collection, terminate the process, or deny service; there is no confidentiality or integrity impact. Only applications that deserialize untrusted MessagePack on this path are affected, such as a reachable ASP.NET Core SignalR hub method with an object parameter and AddMessagePackProtocol() enabled. There is no known public proof of concept and the issue is not listed in CISA KEV; fixes are in 2.5.303 and 3.1.9. Do: Upgrade MessagePack for C# to 2.5.303 or 3.1.9 (or later on that line). Until then, do not deserialize untrusted MessagePack as System.Object through PrimitiveObjectFormatter; review ASP.NET Core SignalR hubs that use AddMessagePackProtocol() with object parameters, and limit message size and request rate on any endpoint that accepts attacker-controlled MessagePack.	5.3	—		MessagePack-CSharp MessagePack for C# prior to 2.5.303 and prior to 3.1.9	—	1d ago
CVE-2026-96951	Windows Shell command injection bypasses a security feature CVE-2026-96951 is a command-injection flaw (CWE-77) in the Windows Shell in which special elements in a command are not properly neutralized. An unauthorized attacker can trigger it remotely with no prior privileges if a user interacts with attacker-controlled content, and Microsoft describes the result as bypassing a security feature; the CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) rates confidentiality, integrity, and availability impacts as high. Affected products named in the data are Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), Windows Server 2012 and 2016, and Outlook on the web. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-10-13, so exploitation in the wild is confirmed; ransomware use is listed as unknown and no public proof-of-concept is known. Do: Apply Microsoft's security updates for every listed Windows and Outlook on the web build as soon as they are available, and follow CISA BOD 26-04 (including cloud guidance or discontinuation if a mitigation is unavailable). Prioritize internet-facing and high-value assets, and because exploitation needs user interaction, reinforce phishing-resistant handling of untrusted content while you patch.	8.8	2%	KEV	Microsoft Windows 10 1607, 1809, 21H2, 22H2 Microsoft Windows 11 23H2, 24H2, 25H2, 26H1, 26H2 Microsoft Windows Server