Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug

Microsoft released patches for 1,413 vulnerabilities in its October 2026 Patch Tuesday, including three critical flaws actively exploited or publicly disclosed. The most notable is CVE-2026-96951, a command injection vulnerability in Windows Shell that allows attackers to bypass Mark of the Web (MOTW) defenses by tricking users into interacting with a malicious file. The vulnerability has been exploited in the wild and added to CISA's Known Exploited Vulnerabilities catalog, requiring federal agencies to patch by October 16, 2026. Another critical flaw, CVE-2026-108398 in .NET Framework, enables local attackers to bypass Windows Defender Application Control without user interaction, making it a dangerous post-compromise technique.

AI-extracted · verify before operational use