Among the more than 1,400 flaws fixed by Microsoft on 13 October, CVE-2026-96951 (CVSS 8.8) is already exploited: it lets a booby-trapped file escape the Mark of the Web protection. Every supported Windows and Windows Server version is affected, and CISA gave US agencies three days to patch.
What happened
Microsoft’s October 2026 Patch Tuesday, published on 13 October, breaks records again: 1,413 vulnerabilities according to The Hacker News, 70 of them critical according to 01net. Only one is marked by Microsoft as already exploited: CVE-2026-96951 (CVSS 8.8), a command-injection flaw in the Windows Shell that lets an attacker get around Mark of the Web (MOTW). That tag is what Windows puts on files coming from the internet or from an email, and it is what triggers SmartScreen and Office Protected View warnings.
CISA added the flaw to its catalogue of exploited vulnerabilities the same day and gave US federal agencies until 16 October to fix it. Microsoft also lists a .NET Framework flaw, CVE-2026-108398 (CVSS 8.8), another protection bypass that was publicly disclosed before the patch but has not been seen in attacks.
Who is affected and how attackers get in
All supported versions are affected: Windows 10, Windows 11 and Windows Server 2012 R2, 2016, 2019, 2022 and 2025, Server Core included. The attack is not automatic: according to Microsoft, the victim has to open a crafted file received by email or instant messaging, or follow a link to a malicious site. Without the MOTW tag, the file opens without the usual warning. On the server side, the exposure is concentrated on Remote Desktop Services hosts and admin jump servers, where people read mail and browse the web.
What to do now
- Deploy the October cumulative update, first on workstations and RDS servers, then everywhere: KB5126646 (Windows Server 2025), KB5126655 (2022), KB5126651 (2019), KB5126868 (2016), KB5126836 (2012 R2), KB5127648 (Windows 11 24H2 and 25H2), KB5126657 (Windows 10 21H2 and 22H2).
- Check that it is really installed: in PowerShell,
Get-HotFix -Id KB5126655(with the KB for your version), or read the build revision with(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').UBR. Expected minimums: 20348.5761 for Server 2022, 17763.9376 for Server 2019, 26100.33650 for Server 2025. - Filter attachments at the mail gateway: block shortcuts, scripts, disk images and password-protected archives that your users have no reason to receive.
- Review your EDR alerts from the past days for unusual processes launched by explorer.exe or Outlook.
Our take
A MOTW bypass does not take over a server by itself, but it removes the last warning between a malicious attachment and a click. With more than 1,400 fixes in a month, the only workable rule is to triage: flaws marked as exploited go out within days, starting with the machines where people read their email.
Sources
- Microsoft — Security Update Guide, CVE-2026-96951
- CISA — Known Exploited Vulnerabilities Catalog, CVE-2026-96951
- 01net — Plus de 1 400 failles Windows : le nouveau record monstrueux du Patch Tuesday de Microsoft
- The Hacker News — Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug
How we choose, verify and write our analyses →
Stolen logins often start with a phishing message. Received a suspicious SMS or email? Check it before you click:
Worried your servers are exposed? Our team audits, patches and monitors Linux and cloud infrastructure 24/7.
Talk to an expert Our managed server services →
