On 13 October 2026, Microsoft released a record-breaking Patch Tuesday security update bundle. Sources differ on the exact number of vulnerabilities fixed — according to Tenable, it addresses 1407 CVE, while some publications cite 1413. Regardless of the exact figure, the scale is unprecedented: according to Tenable, Microsoft has already closed more than 4000 CVE in 2026 alone. Among the vulnerabilities fixed is CVE-2026-96951, a command injection vulnerability in Windows Shell with a CVSS score of 8.8 that is already being exploited in real-world attacks and has been added to the CISA KEV catalog with a remediation deadline for federal agencies of 16 October 2026. All organizations using Windows must prioritize installing these updates.
CVE-2026-96951: exploited Windows Shell vulnerability
The CVE-2026-96951 vulnerability is a command injection (CWE-77) issue in the Windows Shell component with a CVSS score of 8.8. According to the CVE record, the vulnerability allows an unauthenticated attacker to bypass security mechanisms over the network. Successful exploitation enables an attacker to bypass the Mark of the Web (MOTW) protection — the mechanism that tags files downloaded from the internet and warns the user before opening them.
User interaction is required for exploitation: the attacker must convince the victim to follow a link or open a malicious attachment received via email or messenger. It is not possible to trigger exploitation forcibly without user action.
Microsoft confirms that the vulnerability was exploited before the update was released. However, neither Microsoft nor CISA has disclosed details of the attacks — who is behind the exploitation, which organizations were targeted, or which indicators of compromise are associated with the campaign. Microsoft credits the discovery of the vulnerability to researchers from Fujitsu and Anthropic as well as an independent researcher, but no independent confirmation of this attribution has been found.
CVE-2026-108398: WDAC bypass via .NET Framework
The second significant vulnerability, CVE-2026-108398 (CVSS 8.8), affects the .NET Framework and was publicly disclosed before a patch was available. According to Tenable and Rapid7, the vulnerability allows an attacker with existing local access to register a malicious .NET assembly to be loaded by a protected process, thereby bypassing Windows Defender Application Control (WDAC) restrictions. No user interaction is required.
This makes CVE-2026-108398 particularly dangerous as a post-exploitation technique: an attacker who has already established a foothold on a system can use it to bypass application control policies, execute unauthorized code, and weaken endpoint protection. The 13 October 2026 .NET Framework update addresses this vulnerability. Discovery is attributed to James Forshaw of Google Project Zero.
Important clarification: in a number of publications the CVE-2026-108398 and CVE-2026-92707 identifiers are swapped — MSRC links point to the description of a different vulnerability. Independent sources — Tenable, Rapid7, and GitHub Advisory — confirm that CVE-2026-108398 relates to .NET Framework, while CVE-2026-92707 applies to MessagePack-CSharp.
CVE-2026-92707: denial of service in MessagePack-CSharp
The CVE-2026-92707 vulnerability (CVSS 5.3, CWE-1325) affects the MessagePack-CSharp library and can cause a denial of service through uncontrolled sequential memory allocations during deserialization of attacker-controlled data. According to the project’s official advisory, affected versions are those below 2.5.303 and versions from 3.0 up to but not including 3.1.9. The fixed versions are 2.5.303 and 3.1.9. The vulnerability was publicly disclosed before the patch was released.
CVE-2026-21413: critical buffer overflow
CVE-2026-21413 (CVSS 9.8) also deserves special attention — it is a heap-based buffer overflow that can lead to remote code execution. Exploitation can be triggered when generating a thumbnail or preview of a specially crafted RAW image — the user does not even need to open the file. However, there is a discrepancy in the attribution: the source material points to the Raw Image Extension component, whereas the NVD entry identifies the affected product as LibRaw with Talos listed as the CNA. Until this contradiction is resolved, you should check for updates for both components.
Scale of the release and a new approach to prioritization
According to Tenable, the October release includes around 69 critical and more than 1300 important vulnerabilities affecting 301 products and components. The majority of the vulnerabilities are related to privilege escalation and remote code execution. This volume continues a trend: last month Microsoft fixed about 1000 vulnerabilities.
Alongside the updates, Microsoft introduced the concept of “risk cohorts” — grouping CVE that require a similar assessment effort from customers. Microsoft emphasizes that cohorts are a starting point and not a replacement for an individual analysis of each CVE based on exploitation status, attack vector, and user interaction. We have previously written about the issues with Microsoft’s vulnerability classification — the new tool is intended to partially address the prioritization challenge at these scales.
Prioritization recommendations
- CVE-2026-96951 — install the patch immediately. The vulnerability is being exploited, has been added to CISA KEV, and the federal deadline is 16 October 2026. It affects all Windows systems with the Windows Shell component.
- CVE-2026-108398 — a priority for organizations using WDAC and .NET Framework. It is especially critical in environments where there is a risk of local access being compromised.
- CVE-2026-21413 — a priority for systems that process RAW images. The CVSS score of 9.8 and the possibility of exploitation without opening the file make this vulnerability extremely dangerous.
- CVE-2026-92707 — update MessagePack-CSharp to version 2.5.303 or 3.1.9 for applications that use this library.
The October Patch Tuesday sets a new bar for the volume of fixes, but the key issue is not the number of CVE, it is the speed of response to confirmed threats. The first priority is CVE-2026-96951: the patch must be installed by 16 October, as exploitation is already underway. For CVE-2026-108398, it is critically important to assess whether WDAC is deployed in your infrastructure — if it is, the .NET Framework update is no less urgent. Organizations dealing with large volumes of updates should consider Microsoft’s risk cohort concept as an additional sorting tool, but not as a replacement for their own assessment of the exploitability of each vulnerability.
