Threat reportVulnerabilityTL-2026-3443
October 2026 Microsoft Patch Tuesday: Exploited Windows Shell MotW Bypass (CVE-2026-96951), 1,417 Vulnerabilities Patched
October 2026 Microsoft Patch Tuesday (TL-2026-3443), also tracked as October 2026 Patch Tuesday, is a critical-severity software vulnerability scored CVSS 8.8, first published 2026-10-13. It has no confirmed attribution, affects Microsoft Windows (Windows Shell), references 8 CVEs (CVE-2026-96951, CVE-2026-108398, CVE-2026-70571), maps to 8 MITRE ATT&CK techniques (T1190, T1203, T1204.002), and is covered by 9 detection rules and 17 indicators of compromise.
- CVSS
- 8.8/10Critical
- CVEs
- 8Referenced vulnerabilities
- Techniques
- 8MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 17Indicators of compromise
Key facts for TL-2026-3443
- Threat ID
- TL-2026-3443
- Also known as
- October 2026 Patch Tuesday
- Severity
- CRITICAL
- CVSS
- 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, enterprise, technology
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 17
- Updates
- 2026-10-13 · revalidated 1× · latest source
How October 2026 Microsoft Patch Tuesday works
Microsoft's October 2026 Patch Tuesday addressed 1,417 vulnerabilities, 76 rated critical. CVE-2026-96951 (Windows Shell security feature bypass of Mark of the Web, command injection) is exploited in the wild and was added to CISA KEV on 2026-10-13; CVE-2026-108398 (.NET Framework) was publicly disclosed before the patch.
Microsoft released fixes for 1,417 vulnerabilities on 2026-10-13, 76 of them rated Critical (seven critical issues require no customer action). The SANS Internet Storm Center summary identifies one vulnerability already exploited and one publicly disclosed before release.
CVE-2026-96951 is a Windows Shell security feature bypass. NVD describes it as improper neutralization of special elements used in a command (CWE-77, command injection) that allows an unauthorized attacker to bypass a security feature over a network, with CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). SANS describes the effect as bypassing the Mark of the Web (MotW), making it easier to execute code by sending a malicious file through e-mail or instant messaging; the user must still open the file. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-10-13 as 'Microsoft Windows Command Injection Vulnerability' with a federal remediation due date of 2026-10-16; known ransomware campaign use is listed as Unknown. No public information on the exploiting actor, campaign, or payload was found in the sources reviewed.
CVE-2026-108398 is a .NET Framework security feature bypass (untrusted search path, CWE-426; CVSS 8.8, AV:L/AC:L/PR:L/UI:N/S:C) that could bypass application control and execute unauthorized applications. It was publicly disclosed before the patch; no exploitation was detected. CVE-2026-70571 is a Microsoft Exchange Server stack-based buffer overflow (CWE-121) leading to remote code execution, CVSS 8.1 (AV:N/AC:H), triggered by a specific e-mail during content conversion; it is rated Critical and affects Exchange 2016 CU23, 2019 CU14/CU15 and Subscription Edition RTM prior to the fixed builds. Windows DHCP Server received ten RCE fixes, five Critical; CVE-2026-88117 (use after free, CWE-416, CVSS 8.1, AV:N/AC:H) affects Windows Server 2012 through 2025, and CVE-2026-88119, CVE-2026-88120 and CVE-2026-88171 carry the same 8.1 base score. The release also contains a notably large number of Office fixes, and several 9.8-scored RCEs (e.g., Windows Shell CVE-2026-83782, Windows Rich Text Edit Control CVE-2026-70096) per SANS ISC's table.
Note: the SANS summary text was read in full for the first ~100,000 of ~156,000 characters, and the remainder was scanned for notable entries; the full CVE table was not exhaustively reviewed. Vendor MSRC pages could not be retrieved, so exploitation details beyond the SANS and CISA statements are not available.
MITRE ATT&CK techniques used in TL-2026-3443
Initial Access
T1190 Exploit Public-Facing Application; T1566.001 Spearphishing Attachment; T1566.003 Spearphishing via Service
Execution
T1203 Exploitation for Client Execution; T1204.002 Malicious File
Impact
T1499.004 Endpoint Denial of Service: Application or System Exploitation
defense-impairment
T1553.005 Mark-of-the-Web Bypass
stealth
Affected products and versions in October 2026 Microsoft Patch Tuesday
- Microsoft — Windows (Windows Shell)
Vulnerable versions: Supported Windows versions prior to October 2026 updates
Fixed in: October 2026 cumulative updates - Microsoft — .NET Framework
Vulnerable versions: Versions prior to October 2026 update
Fixed in: October 2026 .NET Framework update - Microsoft — Exchange Server
Vulnerable versions: 2016 CU23 < 15.01.2507.077; 2019 CU14 < 15.02.1544.050; 2019 CU15 < 15.02.1748.055; Subscription Edition RTM < 15.02.2562.056
Fixed in: 15.01.2507.077; 15.02.1544.050; 15.02.1748.055; 15.02.2562.056 - Microsoft — Windows Server (DHCP Server)
Vulnerable versions: 2012 through 2025 including Server Core, prior to October 2026 updates
Fixed in: October 2026 cumulative updates
Remediation for October 2026 Microsoft Patch Tuesday
Patches
- October 2026 cumulative updates for Windows and Windows Server
- Exchange Server 2016 CU23 / 2019 CU14 / 2019 CU15 / Subscription Edition RTM updates (fixed builds 15.01.2507.077, 15.02.1544.050, 15.02.1748.055, 15.02.2562.056)
- October 2026 .NET Framework security update (CVE-2026-108398)
Immediate actions
- Apply the October 2026 Microsoft security updates, prioritizing CVE-2026-96951 (CISA KEV due date 2026-10-16)
- Prioritize patching internet-reachable Exchange Server (CVE-2026-70571) and Windows DHCP Server hosts
- Hunt for user-opened files delivered via e-mail or instant messaging that execute code without MotW prompts
Workarounds
- Restrict inbound DHCP traffic to trusted segments until DHCP Server updates are applied
- Limit execution of files from e-mail/IM download locations via application control
Longer-term hardening
- Enforce application control (WDAC/AppLocker) and review .NET Framework search-path exposure
- Maintain a patch cadence aligned to CISA KEV deadlines
- Train users to treat files received via e-mail or IM as untrusted even when no warning is shown
CVEs associated with October 2026 Microsoft Patch Tuesday
CVE-2026-96951, CVE-2026-108398, CVE-2026-70571, CVE-2026-88117, CVE-2026-88119, CVE-2026-88120, CVE-2026-88171, CVE-2026-92707
Weaknesses (CWE) in October 2026 Microsoft Patch Tuesday
Timeline of October 2026 Microsoft Patch Tuesday
- Outlook.com is reported (hol.org, secondary tracker) to have been fixed service-side for CVE-2026-96951, ahead of the Windows updates.
- BleepingComputer publishes its Patch Tuesday analysis naming three zero-days; CVE-2026-108398 is credited to James Forshaw of Google Project Zero, and CVE-2026-92707 (MessagePack-CSharp DoS) is listed as publicly disclosed.
- SANS Internet Storm Center publishes its October 2026 Patch Tuesday summary.
- CISA adds CVE-2026-96951 to the Known Exploited Vulnerabilities catalog.
- NVD publishes CVE-2026-96951 (Windows Shell command injection / security feature bypass, CVSS 8.8), reported exploited in the wild.
- NVD publishes CVE-2026-88117 (Windows DHCP Server use-after-free RCE, CVSS 8.1).
- NVD publishes CVE-2026-70571 (Exchange Server stack-based buffer overflow RCE, CVSS 8.1).
- Microsoft releases October 2026 Patch Tuesday updates addressing 1,417 vulnerabilities, 76 rated Critical, one exploited and one publicly disclosed.
- CISA KEV remediation due date for CVE-2026-96951.
Update history for TL-2026-3443
- 2026-10-13 — Microsoft October 2026 Patch Tuesday: 1,411 flaws fixed, 3 zero-days incl. actively exploited Windows Shell MotW bypass (CVE-2026-96951): What changed No field escalation: severity (CRITICAL), exploitability (ACTIVE), status, CVSS 8.8 and attribution are all unchanged. The update is purely additive. New indicators (7) Behavioral indicators for CVE-2026-108398 and CVE-2026-927
Sources cited for October 2026 Microsoft Patch Tuesday
Detection coverage for TL-2026-3443
As of 2026-10-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3443 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.