Windows Shell and .NET Framework: Microsoft Ships 1,413 Patches for 3 Zero-Days in October
Microsoft issued 1,413 patches in October, including fixes for three zero-day vulnerabilities affecting Windows Shell and .NET Framework components.
Key points
- Microsoft published patches for 1,413 vulnerabilities during October 2026 Patch Tuesday.
- One Windows Shell flaw, CVE-2026-96951, is confirmed exploited in the wild.
- Windows Server 2012 does not receive a security update for this release.
Microsoft released 1,413 security updates on October 2026 Patch Tuesday, addressing a significant volume of flaws across its software portfolio. The release includes patches for three zero-day vulnerabilities, one of which is actively being exploited in the wild.
What happened
Microsoft published fixes for 1,413 own-product vulnerabilities in October 2026, with 1,102 affecting Windows components, according to Rapid7. CrowdStrike noted that the batch includes three zero-day flaws and 75 critical vulnerabilities.
One exploited zero-day, CVE-2026-96951, affects the Windows Shell. This flaw allows attackers to bypass the Mark of the Web security feature, preventing Windows from providing a dialog explaining that Windows protected the PC. Exploitation requires a user to open a malicious file or visit a compromised site.
A second vulnerability, CVE-2026-108398, involves a security feature bypass in the .NET Framework. Microsoft is aware of public disclosure for this flaw. It allows attackers with an existing foothold to bypass Windows Defender Application Control by registering malicious assemblies.
Microsoft is aware of exploitation in the wild for just one of the vulnerabilities published, as well as public disclosure for two others. Notably, Windows Server 2012 does not receive a patch for these issues, although Server 2012 R2 does.
Why it matters
The sheer volume of vulnerabilities continues to rise, making it difficult for security teams to prioritise remediation efforts. The presence of multiple zero-days, including one actively exploited, highlights the urgency of applying these updates.
The Windows Shell flaw is particularly concerning because it disables a key user-facing warning mechanism. This prevents Windows from alerting users about potentially dangerous files, increasing the risk of successful phishing or malware delivery campaigns.
The .NET Framework bypass affects systems relying on application control policies. If attackers can bypass these controls, they gain greater persistence and execution capabilities within compromised environments.
Next steps
- Verify that all supported Windows endpoints have received the October 2026 updates.
- Identify any remaining Windows Server 2012 instances and plan for migration or isolation.
- Review application control logs for signs of unauthorised assembly loading.
Detection notes
Security teams should monitor for unusual file executions that bypass standard warnings. Check for processes launching from unexpected locations or with missing Mark of the Web attributes. Look for attempts to register new .NET assemblies by low-privilege accounts. Analyse browser logs for visits to known malicious domains that could trigger shell exploits. Isolate affected endpoints immediately to prevent lateral movement.
What to do and how to stay safe
- Apply the October 2026 security updates to all supported Windows systems as
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production
General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.
