Skip to content
Indene
en

Alertas de segurança

October Patch Tuesday fixes Windows Shell zero-day already exploited in attacks

On October 13, Microsoft released a record-breaking package of fixes, addressing approximately 1,400 vulnerabilities. CVE-2026-96951, in Windows Shell, is already being exploited and is listed in CISA's KEV catalog, with a remediation deadline of October 16. See what to prioritize.

By Leonardo Araujo IevaAnalista de segurança ofensiva

3 min read

Rede de pontos ligados por traços finos sobre fundo escuro esverdeado, com um único nó em âmbar aceso e o título Over 1,400 fixes, one already under attack.
Rede de pontos ligados por traços finos sobre fundo escuro esverdeado, com um único nó em âmbar aceso e o título Over 1,400 fixes, one already under attack.

On October 13, 2026, Microsoft published its monthly security update package, which BleepingComputer reports as the largest ever released, with approximately 1,411 vulnerabilities. Among them is one already exploited in attacks: CVE-2026-96951, in Windows Shell, which bypasses a system security feature. CISA included the vulnerability in its Known Exploited Vulnerabilities (KEV) catalog on the same day, with an October 16 deadline for remediation by U.S. federal civilian agencies.

What is known

item detail
Identifier CVE-2026-96951
Product Windows (Windows Shell component)
Type Command injection that allows bypassing a security feature, Mark of the Web, according to BleepingComputer; CISA describes the feature bypass as "over the network"
Status Actively exploited; Microsoft has not disclosed how the attack occurs or who reported it
In CISA's KEV catalog Yes, since October 13, 2026 · U.S. federal deadline on October 16
Use in ransomware Unknown, according to CISA

Mark of the Web is the tag that Windows places on files downloaded from the internet or received via email, prompting the system to warn the user before opening them. A vulnerability that bypasses this tag removes one of the remaining warnings against malicious attachments and downloads. The details of the exploitation are not public, so the scale of the campaign cannot be determined.

The package also includes other items that deserve attention:

  • Two publicly disclosed zero-days, but without known exploitation: CVE-2026-108398, in .NET Framework, which can bypass WDAC (Windows Defender Application Control) and requires an authenticated attacker with local access; and CVE-2026-92707, in the MessagePack-CSharp library, of moderate severity.
  • 70 critical vulnerabilities, of which 57 are remote code execution. Among them, according to Microsoft's table reproduced by BleepingComputer, a remote execution in Active Directory Domain Services (CVE-2026-70229), two spoofing vulnerabilities in AD FS (CVE-2026-96222 and CVE-2026-108131), and a remote execution in Azure App Service (CVE-2026-77900).
  • End of support: The October update is the last for Windows 11 24H2 (Home and Pro editions) and for Windows 10 Enterprise LTSB 2016.

Why it matters to financial institutions

The record volume is a queuing problem, not an average severity issue. With over a thousand fixes in a month, the team applying everything in the same window risks delaying the ones that truly matter. The Windows Shell vulnerability is already being exploited. Those in Active Directory and AD FS, even without known exploitation, affect the system that controls identity and access across almost the entire institution, and it is there that the compromise of one server turns into a network-wide compromise.

There is also the context of the week: BleepingComputer lists, in the same cycle, exploited vulnerabilities in Citrix, FortiMail, Ivanti, and SonicWall. Those responsible for remediation are dealing with multiple fronts simultaneously, and prioritizing based on confirmed exploitation supports decisions in the face of audits.

What to do now

  1. Apply the October update to Windows workstations and servers, starting with machines that receive email and browse the internet. Use CISA's October 16 deadline as a reference for urgency, even if the institution is not subject to the U.S. directive.
  2. Prioritize domain controllers and federation servers (AD DS and AD FS) in the same window, due to critical vulnerabilities in these components.
  3. Inventory Windows 11 24H2 Home and Pro and Windows 10 Enterprise LTSB 2016, which will no longer receive security updates, and define what will be migrated.
  4. While the fix has not reached all equipment, reinforce the blocking of external attachments and files in email filters and proxies. This is an Indene recommendation, not from the manufacturer.
  5. Record the application and verification, with date and responsible party: this is the evidence that auditors will request.

References

Topics

Keep reading

All news