Patching
October Patch Tuesday: a MOTW zero-day in 1,400 fixes
Microsoft's October release breaks September's record and fixes an exploited Mark of the Web bypass. Builds to check, what to patch first, and which Windows editions just lost support.
Microsoft's October 13 security release is the largest it has shipped, beating September's record by more than 400 fixes. One flaw, CVE-2026-96951 in Windows Shell, was already being used in attacks: it lets a file downloaded from the internet open without the Mark of the Web warnings that normally stop it. CISA added it to its Known Exploited Vulnerabilities (KEV) catalog the same day and gave US federal agencies until October 16 to patch.
Every supported Windows 10, Windows 11 and Windows Server version from 2012 R2 to 2025 is affected. The same release is also the last one for two groups of machines: Windows 11 24H2 Home and Pro, and Windows 10 Enterprise LTSB 2016. If you run either, this month's update is the final free fix they will get.
Why nobody agrees on the total
BleepingComputer counts 1,411 flaws, 70 of them critical, and three zero-days: one exploited and two publicly disclosed before a fix existed. Tenable counts 1,407, Action1 1,409, Dark Reading and CrowdStrike 1,413, and SecurityOnline 1,414. Critical counts run from 70 (BleepingComputer) through 75 (CrowdStrike) to 80 (Action1).
The gap comes from what each tracker includes. BleepingComputer counts only what Microsoft published on Patch Tuesday itself and leaves out 348 flaws Microsoft fixed earlier in October. The other trackers do not spell out their rules the same way, so the spread most likely comes from whether earlier fixes, third-party components and cloud-side fixes are counted. A few much smaller totals are also circulating, and they cover one product family, not the whole release. The zero-day count differs too: BleepingComputer and CrowdStrike say three, while Ivanti and Action1 list only the exploited Shell flaw and one disclosed .NET flaw. None of the reports we found names a second disclosed one.
For planning, the exact number matters less than the fact that every tracker lands around 1,400 and agrees on which flaw is under attack.
How the Windows Shell bypass works
When a browser or mail client saves a file from the internet, Windows attaches a small hidden tag to it, an alternate data stream called Zone.Identifier with ZoneId=3. That tag is the Mark of the Web (MOTW). Windows Shell, SmartScreen and Office Protected View read it and show a warning, block the file, or open it read-only.
CVE-2026-96951 (CVSS 8.8, rated Important) lets a crafted file get past those checks, so it opens as if it came from the local disk. Microsoft calls it a security feature bypass. CISA's KEV entry and Action1 describe the root cause as command injection (CWE-77), meaning the Shell fails to neutralise special characters in a command it builds. The attack still needs a person to open the file, delivered by email, chat or a download link. Rapid7 notes it is not remote code execution on its own: it removes the warning that would have stopped the payload.
Microsoft has not said who used it, against whom, or how the exploit file is built. No public indicators of compromise had been published by October 14.
The disclosed .NET flaw
CVE-2026-108398 is a .NET Framework security feature bypass, also CVSS 8.8. An attacker who already has a foothold places a crafted .NET assembly on the machine and registers it to be loaded by a protected process. The code then runs inside that process outside the rules of Windows Defender Application Control (WDAC), the Windows feature that decides which code may run. Details were public before the patch, but Microsoft has seen no exploitation.
It matters most where WDAC is the control that keeps unapproved code off servers or kiosks. On those hosts, treat the .NET update as part of today's work.
The rest of the release
The Zero Day Initiative (ZDI) and Cisco Talos both flag five Outlook remote code execution flaws rated CVSS 9.8 that trigger from the Reading Pane: previewing a message is enough, with no click and no login. They include CVE-2026-70242, CVE-2026-70291, CVE-2026-88156 and CVE-2026-97016. None was reported as exploited. ZDI calls them the closest thing to wormable in this month's Office fixes, since one malicious message can be sent to every mailbox in a company.
What to do
- Install this month's cumulative update everywhere. For Windows 11 it is KB5127648. Check the build afterwards: 26100.9711 on 24H2, 26200.9711 on 25H2 and 26300.9711 on 26H2. In PowerShell,
(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').UBRshould return 9711. Restart the machine; the fix is not active until then. - Install the .NET Framework update in the same window, starting with hosts that rely on WDAC.
- Patch Outlook and Office next, starting with the mailboxes of people who handle outside mail all day: finance, HR, sales and support.
- If you cannot patch today, block the file types that usually carry MOTW bypasses at the mail gateway and in chat tools:
.lnk,.url,.iso,.img,.vhd,.vhdx,.htaand.js. In Microsoft Defender, turn on the attack surface reduction rule "Block JavaScript or VBScript from launching downloaded executable content" in block mode. For the Outlook flaws, turn off the Reading Pane on unpatched machines. - Look for signs of use. With no published indicators, hunt on behaviour. In Defender for Endpoint, query
DeviceProcessEventsforexplorer.exestartingmshta.exe,wscript.exe,cscript.exeorpowershell.exewith a command line that points into\Downloads\,\AppData\Local\Temp\or the Outlook attachment cache (INetCache\Content.Outlook). Any hit in the weeks before October 13 deserves a look at the parent file and where it came from.
If you find a hit, treat the machine as compromised: isolate it, reset the user's password and sessions, and check for new scheduled tasks and Run keys.
Two Windows editions just lost support
Windows 11 24H2 Home and Pro reached end of servicing on October 13. This month's update is their last. Move them to 25H2, which installs on 24H2 as a small enablement package and keeps updates coming until October 12, 2027. 24H2 Enterprise and Education stay supported until the same date.
Windows 10 Enterprise LTSB 2016 also reached end of support on October 13. Machines keep working, but next month's fixes will not reach them. Microsoft sells Extended Security Updates for up to three years through Volume Licensing or a Cloud Solution Provider. The long-term fix is Windows 11 Enterprise LTSC 2024 or IoT Enterprise LTSC 2024. LTSB 2016 tends to sit on equipment nobody thinks of as a PC: kiosks, lab instruments and factory HMIs. Search your inventory for build 14393 to find them.
Two record months in a row mean patch volume alone can no longer set the order of work. Knowing which machines open outside mail, which rely on WDAC and which run an edition near its end date turns 1,400 fixes into a short list. Our on-demand risk reduction team can help work through the backlog, and our safeguarding and hardening work covers attack surface reduction rules and mail filtering. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would do the work.
Sources: BleepingComputer, Tenable, CISA KEV alert, Dark Reading, CrowdStrike, Rapid7, Action1, Ivanti, Zero Day Initiative, Cisco Talos, Microsoft on CVE-2026-108398, Winaero on KB5127648, Pureinfotech, BleepingComputer on 24H2 end of support, Windows Central on LTSB 2016.