# October 2026 Microsoft Patch Tuesday: Exploited Windows Shell MotW Bypass (CVE-2026-96951), 1,417 Vulnerabilities Patched

> Microsoft's October 2026 Patch Tuesday addressed 1,417 vulnerabilities, 76 rated critical. CVE-2026-96951 (Windows Shell security feature bypass of Mark of the Web, command injection) is exploited in the wild and was added to CISA KEV on 2026-10-13; CVE-2026-108398 (.NET Framework) was publicly disclosed before the patch.

- **Published:** 2026-10-13T19:43:31Z
- **Last reviewed:** 2026-10-14T01:29:36.183Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3443
- **ID:** TL-2026-3443
- **Severity:** CRITICAL (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-96951, CVE-2026-108398, CVE-2026-70571, CVE-2026-88117, CVE-2026-88119, CVE-2026-88120, CVE-2026-88171, CVE-2026-92707, CVE-2026-96207, CVE-2026-94510, CVE-2026-100202, CVE-2026-100219, CVE-2026-105016, CVE-2026-97814, CVE-2026-96934, CVE-2026-70147, CVE-2026-70153, CVE-2026-88178, CVE-2026-70242, CVE-2026-70291, CVE-2026-97016, CVE-2026-88156, CVE-2026-97749, CVE-2026-70300, CVE-2026-77900, CVE-2026-88131, CVE-2026-69435, CVE-2026-21413, CVE-2026-70229, CVE-2026-70187, CVE-2026-102214, CVE-2026-105733, CVE-2026-96913, CVE-2026-102866, CVE-2026-108131, CVE-2026-96222

## Description

Microsoft released fixes for 1,417 vulnerabilities on 2026-10-13, 76 of them rated Critical (seven critical issues require no customer action). The SANS Internet Storm Center summary identifies one vulnerability already exploited and one publicly disclosed before release.

CVE-2026-96951 is a Windows Shell security feature bypass. NVD describes it as improper neutralization of special elements used in a command (CWE-77, command injection) that allows an unauthorized attacker to bypass a security feature over a network, with CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). SANS describes the effect as bypassing the Mark of the Web (MotW), making it easier to execute code by sending a malicious file through e-mail or instant messaging; the user must still open the file. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-10-13 as 'Microsoft Windows Command Injection Vulnerability' with a federal remediation due date of 2026-10-16; known ransomware campaign use is listed as Unknown. No public information on the exploiting actor, campaign, or payload was found in the sources reviewed.

CVE-2026-108398 is a .NET Framework security feature bypass (untrusted search path, CWE-426; CVSS 8.8, AV:L/AC:L/PR:L/UI:N/S:C) that could bypass application control and execute unauthorized applications. It was publicly disclosed before the patch; no exploitation was detected. CVE-2026-70571 is a Microsoft Exchange Server stack-based buffer overflow (CWE-121) leading to remote code execution, CVSS 8.1 (AV:N/AC:H), triggered by a specific e-mail during content conversion; it is rated Critical and affects Exchange 2016 CU23, 2019 CU14/CU15 and Subscription Edition RTM prior to the fixed builds. Windows DHCP Server received ten RCE fixes, five Critical; CVE-2026-88117 (use after free, CWE-416, CVSS 8.1, AV:N/AC:H) affects Windows Server 2012 through 2025, and CVE-2026-88119, CVE-2026-88120 and CVE-2026-88171 carry the same 8.1 base score. The release also contains a notably large number of Office fixes, and several 9.8-scored RCEs (e.g., Windows Shell CVE-2026-83782, Windows Rich Text Edit Control CVE-2026-70096) per SANS ISC's table.

Note: the SANS summary text was read in full for the first ~100,000 of ~156,000 characters, and the remainder was scanned for notable entries; the full CVE table was not exhaustively reviewed. Vendor MSRC pages could not be retrieved, so exploitation details beyond the SANS and CISA statements are not available.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1566.003 Spearphishing via Service
- T1190 Exploit Public-Facing Application
- T1204.002 Malicious File
- T1553.005 Mark-of-the-Web Bypass
- T1203 Exploitation for Client Execution
- T1574.008 Path Interception by Search Order Hijacking
- T1499.004 Endpoint Denial of Service: Application or System Exploitation
- T1059 Command and Scripting Interpreter
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Defense Evasion
- T1210 Exploitation of Remote Services
- T1611 Escape to Host

## Sources

- [SANS ISC Diary: October 2026 Microsoft Patch Tuesday](https://isc.sans.edu/forums/diary/33422/)
- [NVD: CVE-2026-96951](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-96951)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [NVD: CVE-2026-70571](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-70571)
- [NVD: CVE-2026-108398](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-108398)
- [NVD: CVE-2026-88117](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-88117)
- [MSRC Update Guide: CVE-2026-96951](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951)
- [MSRC Update Guide: CVE-2026-70571](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70571)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3443