> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Update Windows: Record Patch Tuesday fixes flaw already under attack - URL: https://f4n6.co.uk/security-feed/update-windows-record-patch-tuesday-fixes-flaw-already-under-attack/ - Published: 2026-10-14T15:15:13.000Z - Updated: 2026-10-14T15:15:12.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-96951, CVE-2026-108398, CVE-2026-92707 ## 1\. Executive summary Microsoft's October 2026 Patch Tuesday fixes a record 1,413 vulnerabilities, including CVE-2026-96951, a Windows Shell security feature bypass that is confirmed exploited in the wild and is listed in CISA KEV (CVSS 8.8 HIGH, CWE-77, added 2026-10-13). The flaw bypasses Mark of the Web (MOTW), the control that warns users before opening files downloaded from the internet, and exploitation requires a user to open a crafted file or visit an attacker-controlled site. A second flaw, CVE-2026-108398 (.NET Framework, CVSS 8.8 HIGH, CWE-426), was publicly disclosed before the patch and lets an attacker with an existing foothold register a malicious .NET assembly for loading by a protected process, bypassing Windows Defender Application Control (WDAC); it is not in CISA KEV and EPSS is 0%. For EMEA financial services, the exposure is endpoint and email-borne: MOTW bypass removes a warning layer that many firms rely on as a last line of defence against malicious attachments, and WDAC bypass matters most where application control is the primary control on trading, treasury and back-office endpoints. Patch CVE-2026-96951 first; it is the only item here with confirmed in-the-wild exploitation. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 17: ICT-related incident management process | CVE-2026-96951 is confirmed exploited in the wild and bypasses MOTW, a control firms use to gate untrusted files. | If a client endpoint is compromised via this flaw, the incident must be handled under the firm's ICT incident management process, not as a routine patch event. | | DORA Art. 19: reporting of major ICT-related incidents to competent authorities | A successful MOTW bypass leading to code execution on a client endpoint is a candidate major ICT-related incident. | Classification under Art. 18 determines whether the incident is reportable to the competent authority; the reporting clock starts from classification, not from patch deployment. | | NIS2 Art. 21(2)(d): supply chain security measures | The patch is delivered through Microsoft's update channel and the flaw sits in Microsoft-shipped Windows Shell and .NET Framework components. | Firms relying on Microsoft as an ICT provider should confirm the update channel is intact and that patch status is tracked as a supply chain security measure. | No article in the regulatory reference is engaged by CVE-2026-108398 on its own: it requires an existing foothold and no exploitation has been observed. ## 3\. Technical analysis & attack chain This is a vendor patch cycle covering 1,413 CVEs. Two entries warrant full treatment; the remainder are triaged in the table below. ### Prioritised triage | CVE | Component | CVSS | KEV / EPSS | Why it matters | | ------------------------------------------------------------------------------ | ---------------------------------------- | ------------ | ---------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- | | CVE-2026-96951 | Windows Shell | 8.8 HIGH | In CISA KEV (added 2026-10-13) / EPSS 2% | Confirmed exploited in the wild. MOTW bypass removes the download warning that gates untrusted files. | | CVE-2026-108398 | .NET Framework | 8.8 HIGH | Not in KEV / EPSS 0% | Publicly disclosed pre-patch. WDAC bypass allows unauthorized application execution, but requires an existing foothold. | | CVE-2026-70229 | Windows Active Directory Domain Services | 8.1 (source) | Not in KEV / EPSS not given | RCE via crafted packet to AD DS; Microsoft rates exploitation more likely. | | CVE-2026-70571 | Microsoft Exchange Server | 8.1 (source) | Not in KEV / EPSS not given | RCE triggered by a specific email during content conversion; Microsoft rates exploitation more likely. | | CVE-2026-100202 | Windows Message Queuing Queue Manager | 9.8 (source) | Not in KEV / EPSS not given | RCE, use-after-free. | | CVE-2026-100219, CVE-2026-105016 | Microsoft QUIC | 9.8 (source) | Not in KEV / EPSS not given | RCE; use-after-free and heap-based buffer overflow respectively. | | CVE-2026-70279 | Microsoft Exchange Server | 9.3 (source) | Not in KEV / EPSS not given | Spoofing; administrative-privilege target allows access to or modification of organizational data. | | CVE-2026-92707 | MessagePack-CSharp | 5.3 (source) | Not in KEV / EPSS not given | Unauthenticated remote memory exhaustion; exposure depends on how a service uses the library. | | CVE-2026-70242, CVE-2026-97749, CVE-2026-97016, CVE-2026-88156, CVE-2026-70291 | Microsoft Outlook | not given | Not in KEV / EPSS not given | Five separate RCEs where the preview pane is a vector; Outlook may render the preview with no user interaction. | CVSS values for CVEs other than the two in the verified reference data are taken from the source reporting and are not independently verified here. Where the verified data and the source disagree on classification, the verified value governs: CVE-2026-96951 is recorded as CWE-77 (Command Injection) in the verified data, while the source describes it as a Windows Shell security feature bypass; both can describe the same flaw, and the CWE-77 classification is the one to use for control mapping. ### CVE-2026-96951: Windows Shell MOTW bypass (exploited in the wild) 1. The attacker sends the target a specially crafted file by email or instant message, or directs them to an attacker-controlled site. 2. The user opens the file or visits the site. Exploitation requires this user interaction; there is no no-interaction path reported. 3. The crafted file triggers the Windows Shell flaw and the MOTW tag is not applied, so Windows does not display the "Windows protected your PC" dialog. 4. With the warning suppressed, the file executes without the user seeing the usual untrusted-file prompt. The Windows Shell is the GUI interaction logic for the OS, provided by explorer.exe and associated libraries and APIs. This is the third Windows Shell flaw exploited in the wild in 2026, after CVE-2026-21510 (patched February 2026) and CVE-2026-32202 (patched April 2026). Windows Server 2012 does not receive a patch; Server 2012 R2 does. The vulnerability also affected Microsoft's Outlook.com cloud services, which were patched in a build dated several weeks before this release. The advisory credits reporters from multiple organizations, none from within Microsoft. ### CVE-2026-108398: .NET Framework WDAC bypass (publicly disclosed, not exploited) 1. The attacker already holds a foothold on the target system. 2. The attacker registers a malicious .NET assembly on the system. 3. The assembly is loaded by a protected process, and WDAC enforcement is bypassed. 4. The attacker runs unauthorized applications on the target. WDAC is now branded App Control for Business. The patch removes an attacker-controlled location from the list of places .NET Framework searches for registered assemblies, which are typically contained within DLLs and executables. Microsoft has not detected exploitation in the wild. The source describes the mechanism as an untrusted search path, which matches the verified CWE-426 classification. ### Other notable items Five Outlook RCEs (CVE-2026-70242, CVE-2026-97749, CVE-2026-97016, CVE-2026-88156, CVE-2026-70291) use the preview pane as a vector, meaning scrolling past an email in the reading pane can trigger exploitation, and Outlook may render the preview with no user interaction at all. No-interaction Outlook preview pane flaws have featured in state-backed campaigns before, with CVE-2023-23397 as the reference example. CVE-2026-70571 (Exchange Server) is triggered by an attacker sending a specific email that fires the flaw during content conversion; Microsoft rates attack complexity high. CVE-2026-70229 (AD DS) is triggered by a crafted packet to the service. The Windows DHCP Server carries 10 RCEs, five of them critical. ### Confidence caveats CVE counts differ across sources: 1,413 (Malwarebytes, SecurityWeek), 1,407 (Tenable), 1,415 (Cisco Talos), 1,417 (SANS ISC). Critical counts also differ: 69 (Tenable), 76 (SANS), 78 (Krebs), 85 (Talos). Treat the exact totals as approximate; the two CVEs in the verified reference data are the ones with confirmed exploitation and disclosure status. The Outlook preview pane vector and the Exchange content-conversion trigger are single-sourced to Rapid7 and SANS respectively; verify against Microsoft's own advisories before building detection around them. No threat actor is named in any source, and no MITRE ATT&CK profile is available for this activity, so no attribution is made. ## 4\. Mitigation & containment ### P1 (within 24 hours) - Patch CVE-2026-96951 across Windows 10, Windows 11, Windows Server 2012 R2 and later server versions. This is the only item here with confirmed in-the-wild exploitation and it is in CISA KEV. - Patch CVE-2026-108398 on all .NET Framework hosts. It is publicly disclosed and unpatched systems give an attacker with a foothold a WDAC bypass. - Confirm WDAC (App Control for Business) policy is enforced, not audit-only, on endpoints where application control is the primary control. A bypass of an unenforced policy changes nothing. - Verify MOTW is functioning on endpoints that rely on it. If a host has MOTW disabled by policy or by a third-party tool, the CVE-2026-96951 bypass has no additional effect there, but the host is already exposed to every other MOTW-dependent control gap. ### P2 (within 72 hours) - Patch the five Outlook preview pane RCEs and CVE-2026-70571 (Exchange Server). Where Exchange is internet-facing, apply the cumulative update and restart the relevant services. - Patch CVE-2026-70229 (AD DS) on all domain controllers. A crafted packet to the service is the trigger; there is no user interaction. - Patch CVE-2026-100202 (Message Queuing Queue Manager), CVE-2026-100219 and CVE-2026-105016 (QUIC) where those components are enabled. Disable MSMQ on hosts that do not need it. - Patch the Windows DHCP Server RCEs on any host running the role. ### P3 (within 7 days) - Patch the remaining Office, Excel, SharePoint, Word, SQL Server, Windows Kernel, Windows Installer, Win32 Kernel Subsystem, Windows Search, NTFS and Windows Error Reporting items in the release. These are the bulk of the 1,413 and carry no confirmed exploitation. - Patch CVE-2026-92707 (MessagePack-CSharp) in any service that deserializes MessagePack data from untrusted input. Exposure depends on how the service uses the library; inventory first, then patch. - Review whether any Windows Server 2012 (not R2) hosts remain in scope. They do not receive this patch and cannot be remediated by updating. ### Containment where patching cannot be immediate - Block execution of files from user-writable download directories by policy on endpoints that cannot be patched inside 24 hours. - Add email and web gateway rules to strip or quarantine attachments that match the crafted-file patterns in the vendor advisory once Microsoft publishes them. No atomic file indicators are available in the source material for this. - Isolate any host showing unexpected process execution from a downloaded file, particularly where the user reports no warning dialog appeared. ## 5\. Indicators of compromise No indicators of compromise available in the source material. No file hashes, domains, IP addresses, file paths, registry keys or command lines are given in any of the sources for either CVE. The sources describe observable behaviours but no atomic indicators. Those behaviours are listed below. ### Behavioural indicators | Behaviour | Where to observe | Confidence | | ---------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------- | | A file downloaded from email, instant message or a website executes without the "Windows protected your PC" MOTW warning appearing | Endpoint: process creation events for executables in download directories; user reports of a missing warning | High for the mechanism; no atomic indicator available | | A .NET assembly is registered and loaded by a protected process on a host where WDAC is enforced | Endpoint: .NET assembly load events, WDAC audit/block events, process creation for the loading process | High for the mechanism; no atomic indicator available | | Outlook renders a message preview with no user interaction and a process spawns from the Outlook process | Endpoint: process creation with outlook.exe as parent | Medium; single-sourced to Rapid7 | | Exchange content conversion triggers code execution on receipt of a specific email | Exchange server: transport and content conversion logs, process creation on the Exchange host | Medium; single-sourced to SANS | ## 6\. Detection The sources give no file hashes, mutexes, scheduled task names, service names, registry keys or command-line flags. The only artefacts are component names and the behavioural patterns above. A YARA rule built on component names would detect reporting about the flaw, not the flaw, so none is emitted. A Sigma rule for the Outlook preview pane behaviour is possible, because the parent process relationship is a log-observable behaviour rather than a string artefact. ```yaml title: Suspicious Child Process Spawned by Outlook id: 7f3c1a92-4b8e-4d21-9c6a-2e5f8b1d0a34 status: experimental description: Detects a process spawned directly by outlook.exe, consistent with an Outlook preview pane exploitation attempt. Tune against legitimate Outlook integrations before enabling. author: Adverse Trace date: 2026-10-14 references: - https://www.rapid7.com/blog/post/em-patch-tuesday-october-2026 - https://www.malwarebytes.com/blog/bugs/2026/10/update-windows-record-patch-tuesday-fixes-flaw-already-under-attack logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: '\outlook.exe' filter_known: Image|endswith: - '\splwow64.exe' - '\prevhost.exe' condition: selection and not filter_known falsepositives: - Legitimate Outlook add-ins and integrations that launch helper processes - User-initiated attachment opens level: medium ``` No Sigma rule is written for CVE-2026-96951 or CVE-2026-108398 because the sources describe the mechanism but not a log-observable artefact specific to either. Detection for both depends on the behavioural indicators in §5 and on vendor-published signatures once available. ## CVE assessment 2 referenced CVEs — **1 actively exploited (CISA KEV)** | CVE | CVSS | Exploited | EPSS | Summary | | ---------------------------------------------------------------------------------- | -------- | ---------------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-96951](https://nvd.nist.gov/vuln/detail/CVE-2026-96951?ref=f4n6.co.uk) | 8.8 High | ⚠ KEV 2026-10-13 | 2% | Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized att… | | [CVE-2026-108398](https://nvd.nist.gov/vuln/detail/CVE-2026-108398?ref=f4n6.co.uk) | 8.8 High | — | 0% | Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally. | *Could not resolve: CVE-2026-92707.* ## 7\. Sources - Malwarebytes, "Update Windows: Record Patch Tuesday fixes flaw already under attack", https://www.malwarebytes.com/blog/bugs/2026/10/update-windows-record-patch-tuesday-fixes-flaw-already-under-attack, 2026-10-14 - Rapid7, "Patch Tuesday - October 2026", https://www.rapid7.com/blog/post/em-patch-tuesday-october-2026 - Tenable Research, "Microsoft's October 2026 Patch Tuesday addresses 1407 CVEs (CVE-2026-96951)", https://www.tenable.com/blog/microsofts-october-2026-patch-tuesday-addresses-1407-cves-cve-2026-96951 - SANS Internet Storm Center, "October 2026 Microsoft Patch Tuesday", https://isc.sans.edu/diary/rss/33422, 2026-10-13 - Cisco Talos, "Microsoft Patch Tuesday for October 2026 - Snort rules and prominent vulnerabilities", https://blog.talosintelligence.com/microsoft-patch-tuesday-for-october-2026/ - SecurityWeek, "Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day", https://www.securityweek.com/microsoft-patches-record-1413-vulnerabilities-including-exploited-windows-zero-day/ - Krebs on Security, "Microsoft Patches More Than 1,400 Security Flaws", https://krebsonsecurity.com/2026/10/microsoft-patches-more-than-1400-security-flaws/ ## 8\. Adverse Trace position CVE-2026-96951 is the priority: CVSS 8.8 HIGH, in CISA KEV since 2026-10-13, confirmed exploited in the wild, and it removes a warning layer that many EMEA financial services firms treat as a control. CVE-2026-108398 is CVSS 8.8 HIGH but not in KEV, EPSS 0%, and requires an existing foothold, so it is a hardening item rather than an emergency. The remaining 1,411 CVEs carry no confirmed exploitation and should be handled through the normal monthly cycle, with the Outlook preview pane and Exchange items pulled forward because of their trigger conditions. No actor is named in any source and no MITRE ATT&CK profile exists for this activity, so we make no attribution. The Outlook preview pane vector and the Exchange content-conversion trigger are single-sourced; verify against Microsoft's advisories before enforcing detection. Adverse Trace will track Microsoft's advisory for CVE-2026-96951 and CVE-2026-108398, update this note if atomic indicators are published, and re-issue if exploitation of CVE-2026-108398 is observed. Clients who cannot patch CVE-2026-96951 inside 24 hours should contact their Adverse Trace handler to scope compensating controls. --- [Read the original source →](https://www.malwarebytes.com/blog/bugs/2026/10/update-windows-record-patch-tuesday-fixes-flaw-already-under-attack?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*