Patch Windows Now to Fix Exploited Shell Bypass and Record 1,413 Flaws

Microsoft released its October 2026 Patch Tuesday updates on October 13, addressing a record 1,413 vulnerabilities across Windows, Office, .NET, and other products. According to Malwarebytes Labs, this volume reflects Microsoft’s growing use of artificial intelligence to identify and fix security flaws. The release includes three zero-day vulnerabilities: one that attackers are already exploiting in the wild and two that were publicly disclosed before patches became available.

The risk

The most urgent threat is CVE-2026-96951, a Windows Shell security feature bypass with a CVSS score of 8.8. This flaw allows attackers to circumvent the Mark of the Web (MOTW) mechanism, which warns users about potentially unsafe downloaded files. Successful exploitation requires user interaction, such as clicking a link or opening an attachment in an email or instant message. Bypassing MOTW can prevent Windows and supported applications from applying protections like SmartScreen warnings or Office Protected View.

Who is exposed

Systems running Windows are exposed to the Shell bypass if they have not applied the October updates. The flaw specifically targets environments where users interact with downloaded content. Another high-severity risk is CVE-2026-108398, a .NET Framework vulnerability with a CVSS score of 8.8. This flaw allows an authorized attacker to bypass Windows Defender Application Control (WDAC) locally via an untrusted search path, potentially enabling the execution of unauthorized applications on target systems.

Cost and compliance

The sheer volume of patches creates operational challenges for IT administrators managing enterprise environments. According to CrowdStrike’s analysis, the release includes 75 critical flaws, with elevation of privilege, remote code execution, and information disclosure as the most common categories. BleepingComputer counted 1,411 vulnerabilities and 70 critical flaws, noting that discrepancies arise from variations in how researchers tally updates. Identifying the most dangerous flaws while ensuring comprehensive coverage requires careful prioritization.

Our take on the response

Microsoft’s attribution of the record patch count to AI-assisted vulnerability discovery suggests a trend toward higher maintenance overhead for security teams. Defenders should prioritize the actively exploited Shell bypass and the WDAC bypass immediately, as these flaws undermine core trust boundaries. The high volume of patches necessitates robust change management processes to verify application status without disrupting business operations.

What defenders should look for

Security teams should monitor for unusual file execution patterns following user interactions with email attachments or instant message links. Look for alerts indicating that files from untrusted sources bypassed standard warnings or opened without Protected View. Check logs for attempts to run unauthorized applications on systems with Windows Defender Application Control enabled. If suspicious activity is detected, isolate affected endpoints to prevent lateral movement and reset credentials for compromised accounts.

Background: Zero-day vulnerabilities

A zero-day exploit is an attack that leverages a previously unknown software vulnerability before the vendor can release a fix. The "zero days" refers to the time vendors have had to address the flaw. These attacks bypass standard defenses because no patch or signature exists yet.

Read the full guide: What Does Zero Day Exploit Mean: Mechanisms, Risks, and Mitigation

What to do and how to stay safe

• Apply the October 2026 Windows updates immediately to address the exploited Shell vulnerability and other critical flaws.
• Monitor email and instant messaging gateways for malicious attachments or links that might trigger the Shell bypass.
• Verify that Windows Defender Application Control policies are enforced on systems running the .NET Framework to mitigate local privilege escalation risks.
• Educate users to remain cautious with downloaded files, even if standard security warnings appear to be missing.

Step-by-step guide: Unpatched Software Response: Containment, Recovery, and Prevention Steps

General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for the exploited Windows Shell vulnerability?

CVE-2026-96951 has a CVSS score of 8.8 out of 10.

How many vulnerabilities did Microsoft fix in October 2026?

Microsoft fixed a record 1,413 vulnerabilities in its October Patch Tuesday release, according to Malwarebytes Labs and CrowdStrike.