Vulnerabilities · 8h ago
Microsoft’s October Patch Tuesday bundled 1,413 CVEs and put CVE-2026-96951 at the center: Microsoft said the Windows Shell flaw is being exploited in the wild, and CISA added it to the Known Exploited Vulnerabilities list with a federal deadline two days away.
The bug lets a specially crafted file slip past Mark of the Web, the Windows trust tag that tells Defender SmartScreen and Office Protected View to treat internet files cautiously. In plain terms, a file opened from email or chat can arrive without the warning signals that normally slow execution, so the danger is the broken trust gate as much as the Shell flaw itself.
For Windows and Microsoft 365 defenders, the patch problem is now a triage problem: if your controls depend on download-origin tagging, this zero-day can undercut them before other layers get a chance to intervene. The rest of the release is large, but this is the item that sets the response order.
Known exploited · CISA KEV
CVSS 8.8 HIGH: improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an… Microsoft patch: 5126836.
Patch available KB5126836 Download →
CISA federal remediation date Oct 16
16 sources covering this story
Aggiornamenti Mensili Microsoft
Microsoft ha rilasciato gli aggiornamenti di sicurezza mensili che risolvono un totale di 1416 nuove vulnerabilità, di cui una di tipo 0-day.
Boletín mensual de seguridad de Microsoft de octubre de 2026
Microsoft ha publicado actualizaciones para 1.408 vulnerabilidades: 78 de severidad crítica, 1.329 de
Microsoft fixes exploited Mark of the Web bypass vulnerability (CVE-2026-96951) - Help Net Security
In a record-breaking Patch Tuesday, Microsoft has squashed over 1,400 security bugs, including the actively exploited CVE-2026-96951.
Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day
The most important is CVE-2026-96951, a security feature bypass flaw in Windows that has been exploited in the wild.
Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug
Microsoft patched a record 1,413 flaws, including an exploited Windows Shell bug that can bypass Mark of the Web defenses.
Microsoft Releases October 2026 Security Updates
JPCERT-AT-2026-0031 JPCERT/CC 2026-10-14 Microsoft Corporation October 2026 Security Updates https://msrc.microsoft.com/update-guide/releaseNote/2026-Oct According to Microsoft, among the vulnerabilities, the following vulnerability has been confirmed to be exploited in the wild.
Microsoft Patches More Than 1,400 Security Flaws
Microsoft today issued updates to fix more than 1,400 security vulnerabilities in its Windows operating systems and other software.
Zero Day Initiative — The October 2026 Security Update Review
Another month of patches equals another new record for Microsoft patches.
Kwetsbaarheden verholpen in Microsoft Windows
Microsoft heeft 1159 kwetsbaarheden verholpen in Windows.
Kwetsbaarheden verholpen in Microsoft Office
Microsoft heeft xxx kwetsbaarheden verholpen in diverse Office producten, zoals Word, Excel, Access, Outlook, Visio, Sharepoint en PowerPoint, maar ook subcomponenten als Shell, Azure Key Vault en Click-to-Run.
RPC Runtime Information Disclosure Vulnerability
Windows 10 Version 1607: >= 10.0.14393.0, < 10.0.14393.9612
Part of the PlainSec briefing for 2026-10-14