Microsoft Patch Tuesday October 2026

The October edition of the Patch Tuesday update addresses 1400 vulnerabilities, including 3 zero-day vulnerabilities.

The following vulnerabilities were addressed through the update that threat actors exploited to orchestrate attacks:

Through this blog, we will understand the vulnerabilities that require immediate attention and what organizations need to prioritize while remediating across their Microsoft environments.

Products covered

The October security release covers multiple Microsoft products and components, including:

• Windows client and server operating systems
• .NET Framework
• Microsoft Office
• SharePoint
• Windows Kernel and Windows Shell
• Windows Installer
• Windows DNS Server
• Other Microsoft application and platform components

Microsoft has reported that the October security update is also the final update for Windows 11 version 24H2 Home and Pro, as they will no longer receive security updates. Therefore, organizations using these editions should plan to migrate to Windows releases that support security updates.

3 zero-day vulnerabilities addressed

Microsoft’s October Patch Tuesday has addressed 3 zero-day vulnerabilities, of which one was actively exploited, and two have been publicly disclosed before the fixes were available.

CVE-2026-96951 -Windows Shell – Security Feature Bypass

Severity – CVSS 8.8 (High) (Important)

Status – Actively exploited

Microsoft has fixed an actively exploited security feature bypass vulnerability in Windows Shell, tracked as CVE-2026-96951, that was exploited in the wild before the patch was available. The flaw arises because the command input is not handled safely, allowing an attacker to manipulate command processing in such a way that it can bypass a security feature over a network.

An attacker can exploit this flaw to:

• Bypass Windows’ security protections.
• Reduce the security warnings and restrictions associated with files downloaded from untrusted sources.
• Facilitate the delivery of malware through malicious files.
• Improve the likelihood of opening malicious files by the target without triggering security warnings.
• Use the security feature bypass flaw as part of a broader attack against vulnerable systems.

Recommendation: Prioritize deployment of the applicable security update and monitor for suspicious activity involving downloaded files and Windows Shell.

CVE-2026-108398 – .NET Framework – Security Feature Bypass

Severity – CVSS 8.8 (High) (Important)

Status – Publicly disclosed

CVE-2026-108398 is a security feature bypass flaw affecting Microsoft .NET Framework. It arises because of improper protection of the component-loading search path.

Think of the .NET Framework as a system that looks for correct and trusted files to run an application. If the search process itself is not protected, it can allow attackers to place a malicious file where it can be found. When the file is loaded, it allows attackers to bypass application control restrictions and run unauthorized code within a protected process.

An attacker can exploit this flaw to:

• Bypass Windows Defender Application Control (WDAC) restrictions.
• Run unauthorized code in an environment that restricts executable applications/components.
• Load a malicious .NET assembly through a protected process.
• Weaken application control policies designed to prevent untrusted code from running.
• Create more opportunities to advance a broader attack using the compromised process.

CVE-2026-92707 – MessagePack-CSharp – Denial of Service

Severity – CVSS 5.3 (Medium) (Moderate)

Status – Publicly disclosed

This flaw, tracked as CVE-2026-92707, is a denial-of-service flaw that affects MessagePack-CSharp, a serialization library used by .NET applications for processing structured data. It arises because memory is allocated before the library fully checks the permitted nesting depth. This behavior can be exploited by an attacker to cause excessive memory consumption, performance degradation, and crash an affected application.

An attacker can exploit this flaw to:

• Trigger excessive memory allocation using relatively small, specially crafted payloads.
• Cause excessive garbage collection and degrade application performance.
• Exhaust system resources, potentially affecting other processes.
• Crash or terminate affected application processes.
• Sustain service disruption through repeated exploitation of the flaw.

Recommendation: Review exposure of applications using the affected component and apply the applicable security update. The vulnerability details and statuses above are based on Microsoft’s security information and the October 2026 analysis published by the Zero Day Initiative.

Official Mitigation Guidance

Microsoft recommends applying the applicable October 2026 security updates to affected products.

Organizations that cannot immediately deploy the updates should follow any applicable Microsoft-provided mitigations and maintain increased monitoring of affected systems until patching is completed.

SharkStriker’s Recommendations

• Prioritize CVE-2026-96951 because Microsoft has confirmed active exploitation.
• Deploy applicable October 2026 security updates across supported Windows and Microsoft products.
• Identify systems running unsupported operating-system editions and plan upgrades.
• Review the Microsoft Security Update Guide for product-specific vulnerabilities and fixed versions.
• Monitor endpoint telemetry for suspicious Windows Shell activity, unauthorized application execution, and abnormal process behavior.
• Validate patch deployment through vulnerability scanning and endpoint management tools.
• Prioritize internet-facing and business-critical systems according to exposure and risk.
• Maintain a documented exception and remediation process for systems that cannot be patched immediately.

SharkStriker’s Actions

• October 2026 Patch Tuesday intelligence reviewed using Microsoft’s security documentation and supporting technical research.
• The actively exploited Windows Shell vulnerability was identified as a priority remediation item.
• Detection engineering recommended reviewing monitoring for suspicious Windows Shell and application-control activity.
• Threat hunting offered recommendations for environments where relevant indicators or suspicious behavior are identified.