Microsoft shipped its October 2026 Patch Tuesday update on October 13, fixing 1,413 CVEs across Windows, Office, SharePoint, SQL Server, Exchange Server, Azure, and its developer tools, according to Microsoft’s own Security Update Guide release notes. One of the two vulnerabilities Microsoft flagged as notable, CVE-2026-96951, is already being exploited in the wild. If you manage Windows machines for clients or in-house, this month’s release isn’t one to defer.
CVE-2026-96951: the one that’s actually under attack
CVE-2026-96951 is a Windows Shell security feature bypass that lets an attacker evade Mark of the Web (MOTW) protections, the flag Windows attaches to files downloaded from the internet that normally triggers a warning before anything inside gets to run. Microsoft’s advisory describes a command injection flaw (CWE-77) that an attacker can exploit by sending a specially crafted file through email or instant message and convincing the recipient to open it. NVD rates it 8.8 (High) on the CVSS 3.1 scale, and Microsoft’s own release notes mark it “Exploitation Detected” and not publicly disclosed ahead of the patch, meaning this was caught being used before anyone wrote it up.
MOTW bypasses matter more than their CVSS score suggests. They’re the step that turns a routine phishing attachment into a working infection, since most endpoint defenses lean on that warning prompt as a last line of defense before a downloaded file executes. The fix ships as part of the standard October cumulative update (KB5126836 and its sibling KBs across supported Windows versions), so this isn’t an optional download.
Two more worth knowing about
CVE-2026-108398 is a .NET Framework security feature bypass that lets an authenticated attacker register a crafted .NET assembly with a protected process to get around Windows Defender Application Control (WDAC). Microsoft says it was publicly disclosed before the patch but hasn’t seen exploitation yet, and rates further exploitation as less likely. Still worth patching on anything running WDAC as a hardening layer.
Microsoft also republished a third-party advisory from Cisco Talos, CVE-2026-21413, a heap-based buffer overflow in the Windows Raw Image Extension. The notable detail here is that it can trigger through nothing more than Windows generating a thumbnail preview of a malicious RAW image file sitting in a folder. No click, no open, just a folder view. It hasn’t been seen exploited and isn’t publicly disclosed yet, but the zero-click trigger is the kind of thing worth getting ahead of rather than waiting on.
What to actually do about it
- Push the October cumulative update to Windows endpoints and servers this week, not next patch cycle, given the active exploitation of CVE-2026-96951.
- If you run Windows Defender Application Control anywhere, prioritize the .NET Framework update too, since CVE-2026-108398 undermines the control WDAC is there to provide.
- Remind end users that the usual advice, don’t open attachments or links from people you don’t recognize, is exactly what this MOTW bypass depends on to work. The vulnerability doesn’t help an attacker who can’t first get someone to click.
None of this is WordPress or web-stack specific, but a lot of client infrastructure still runs on Windows somewhere: admin workstations, file servers, Exchange mailboxes. A single unpatched machine on an otherwise well-secured network is still an open door.
This is also the fourth actively-exploited or actively-abused zero-day we’ve covered in as many weeks, after Citrix’s NetScaler zero-day, the Atlassian file access flaw, and attackers using Ninja Forms and WooCommerce plugin flaws to hide admin backdoors. Patch cadence matters more this quarter than it has in a while.
