Microsoft marked one flaw in its October 2026 release as exploited, a Windows Shell security feature bypass tracked as CVE-2026-96951.
The October 2026 release notes flag the vulnerability as exploitation detected and not publicly disclosed. Microsoft describes it as improper neutralization of special elements in Windows Shell, a command injection weakness, that lets an unauthorized attacker bypass a security feature over a network. It carries a CVSS base score of 8.8 and an Important severity rating. According to the Microsoft entry, a successful attacker could evade Mark of the Web defenses.
The entry says exploitation needs a user to act. In an email or instant message scenario, the attacker sends a specially crafted file. In a web scenario, the attacker entices the user to click a link to an attacker’s site or open a malicious attachment. Microsoft says an attacker has no way to force a user to view attacker-controlled content. The flaw is one entry in a release of more than 1,400 Microsoft CVEs.
For a security leader, the delivery path sets the order of work. Mail and chat carry the lure, so user endpoints are the first place to install the October cumulative update, ahead of servers that do not open attachments. In our reading, a bypass of Mark of the Web defenses takes one layer out of phishing defense, which leaves attachment detonation and link rewriting at the mail gateway to carry the load. Teams should confirm those controls are active and should not assume a download warning will appear.
The monthly cycle also revises itself. We reported on Microsoft re-releasing September’s Exchange Server updates to add a CVE, and on September’s record Patch Tuesday. Check the October entry again after the first week for revisions.
Source: Microsoft Security Response Center, October 2026 Security Updates
