Microsoft October 2026 Patch Tuesday: exploited Windows Shell MOTW bypass (CVE-2026-96951) and two disclosed .NET flaws

What happened

On 13 October 2026, Microsoft released its October updates. BleepingComputer counts 1,411 flaws, 70 of them rated Critical, and three zero-days: one exploited, two publicly disclosed (BleepingComputer). Krebs on Security reports that Microsoft credits large language models for the high volume of findings (Krebs on Security).

The three that matter most:

• CVE-2026-96951, Windows Shell security feature bypass (exploited). CVSS 8.8. It is a command injection that “allows an unauthorized attacker to bypass a security feature over a network.” Microsoft says the bypassed feature is Mark of the Web (MOTW). The attack needs a user to open a crafted file or click a link, typically sent by email or instant message (MSRC). The CVE record also lists Microsoft Edge before 154.0.4258.62 and Outlook.com as affected (CVE record). Microsoft has not said who is exploiting it or how (BleepingComputer).
• CVE-2026-108398, .NET Framework security feature bypass (publicly disclosed). CVSS 8.8. An authenticated local attacker places a crafted .NET assembly on the system and registers it to be loaded by a protected process. That bypasses Windows Defender Application Control (WDAC) and runs code inside the protected process. No user interaction is needed (MSRC). BleepingComputer credits James Forshaw of Google Project Zero.
• CVE-2026-92707, MessagePack-CSharp denial of service (publicly disclosed). CVSS 5.3. Deserializing attacker data as System.Object lets a small payload force very large memory allocations. The record names a reachable ASP.NET Core SignalR hub method with an object parameter and AddMessagePackProtocol() enabled as an example exposure (CVE record).

Exploitation. Microsoft marks CVE-2026-96951 as “Exploitation Detected” (MSRC). CISA added it to the KEV catalog on 13 October 2026 with a federal due date of 16 October (CISA KEV). Microsoft lists the other two as publicly disclosed and not exploited.

End of updates. BleepingComputer notes that Windows 11 24H2 Home and Pro, and Windows 10 Enterprise LTSB 2016, received their last monthly security update this month. Windows 11 23H2 Enterprise, Education and IoT Enterprise stop receiving updates next month (BleepingComputer).

Am I affected?

Windows. A machine is fixed for CVE-2026-96951 if its build is at or above the number Microsoft lists for its version (CVE record):

Read the build and update revision on a machine:

Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' |
  Select-Object ProductName, DisplayVersion, CurrentBuild, UBR

CurrentBuild and UBR together make the last two parts of the build number (for example 26100 and 9711).

Edge. Open edge://version. Anything below 154.0.4258.62 is affected. Outlook.com is a Microsoft service and needs no action from you.

.NET Framework (CVE-2026-108398). Microsoft lists fixed builds of 4.8.9363.0 for .NET Framework 4.8.1, 4.8.4811.0 for 4.8, and 4.7.4150.0 for 4.6.2 to 4.7.2 (CVE record). You are exposed only if you rely on WDAC to stop users running unapproved code.

MessagePack-CSharp (CVE-2026-92707). Search your .NET solutions for the package:

dotnet list package --include-transitive | grep -i messagepack

Versions below 2.5.303, and 3.x below 3.1.9, are affected (CVE record). It matters most for SignalR hubs that use the MessagePack protocol and accept object parameters.

What to do now

1. Deploy the October cumulative update to all Windows clients and servers, starting with machines where users open email attachments and downloads. CVE-2026-96951 is the reason to go first on these.
2. Update Edge to 154.0.4258.62 or later and confirm with edge://version.
3. Move off end-of-update editions. Windows 11 24H2 Home and Pro and Windows 10 Enterprise LTSB 2016 get nothing after this month. Plan the 23H2 Enterprise and Education fleet now, since it stops next month.
4. If you enforce WDAC, prioritise the .NET Framework update on those machines. Until it is in place, treat WDAC as bypassable by any local user who can register an assembly for a protected process.
5. Bump MessagePack-CSharp to 2.5.303 or 3.1.9 in services that deserialize untrusted input, rebuild and redeploy. Where you cannot, avoid deserializing untrusted data as object.
6. Hunt for MOTW-bypass delivery. Microsoft has not published indicators for CVE-2026-96951. Review email and chat attachments opened in early October that ran without a SmartScreen or “Protected View” prompt, and look for child processes of explorer.exe launched from files in Downloads or mail temp folders.

Sources

• MSRC: CVE-2026-96951 Windows Shell security feature bypass
• MSRC: CVE-2026-108398 .NET Framework security feature bypass
• CVE record: CVE-2026-96951
• CVE record: CVE-2026-108398
• CVE record: CVE-2026-92707
• BleepingComputer: Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days
• Krebs on Security: Microsoft patches more than 1,400 security flaws
• CISA KEV entry: CVE-2026-96951