Microsoft Windows Shell e componentes do Patch… · Disclosed

October Patch Tuesday fixes actively exploited Windows Shell zero-day

Oct 12, 2026 · 1 min read

Microsoft released its October 2026 Patch Tuesday on October 13, fixing a record 1,413 vulnerabilities according to Malwarebytes. The round includes CVE-2026-96951, an actively exploited Windows Shell flaw, plus CVE-2026-108398 (.NET Framework) and CVE-2026-92707 (MessagePack-CSharp), both disclosed before the patch. Apply the October cumulative updates to all supported Windows versions.

By HIFY Radar newsroom Updated 10/26/2026 01:29 PM Get this every day →← Back to the feed 2 sources

HighVulnerabilityDisclosedPatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

Microsoft released its October 2026 Patch Tuesday on October 13. According to Malwarebytes, the round fixes a record 1,413 vulnerabilities, including an actively exploited Windows Shell flaw and two others publicly disclosed before the patch.

Why it matters

The actively exploited flaw, CVE-2026-96951 (CVSS 8.8), bypasses Mark of the Web, the warning about unsafe downloaded files, and requires a user to click a link or open an attachment from email or instant messages. Windows machines without the update are exposed to this kind of attack.

What to do

Apply the October 2026 cumulative updates to all supported Windows systems and confirm via Windows Update that none are pending. Until then, remind staff not to open suspicious attachments or links.

For the technical team

CVE: CVE-2026-96951, CVE-2026-108398, CVE-2026-92707
Affected: Microsoft Windows Shell e componentes do Patch Tuesday de outubro · Supported Windows versions receiving the October 2026 cumulative updates; per-SKU details in the Microsoft Security Update Guide, cited by BleepingComputer.
Exploitation: CVE-2026-96951 reported as actively exploited (zero-day) by Malwarebytes. CVE-2026-108398 and CVE-2026-92707 were publicly disclosed before the patch, according to Malwarebytes.
Fix: October 2026 Patch Tuesday cumulative updates (KB packages per Windows SKU).
Vector: CVE-2026-96951 (CVSS 8.8): Windows Shell security feature bypass; defeats Mark of the Web (MOTW) and requires user interaction, such as clicking a link or opening an attachment in an email or instant message attack. CVE-2026-108398 (CVSS 8.8): untrusted search path in .NET Framework; an authorized attacker locally bypasses Windows Defender Application Control (WDAC) and may run unauthorized applications. CVE-2026-92707 (CVSS 5.3): unauthenticated remote attacker exhausts memory in applications that process specially crafted MessagePack data; the component involved is MessagePack-CSharp and exposure depends on how the service uses the library.
More details: BleepingComputer counts 1,411 flaws and 3 zero-days in the round; Malwarebytes counts a record 1,413 vulnerabilities. Microsoft said its growing use of AI to find vulnerabilities means users should expect more fixes in monthly updates. Disclosure on October 13, 2026.