Microsoft Patches 3 Zero-Days This Patch Tuesday: One Is Already Being Exploited
Microsoft's October 2026 Patch Tuesday landed this week with a record 1,411 vulnerability fixes, including three zero-days. One of them, a Windows Shell bypass already being exploited in the wild, needs your attention right now.
The Three Zero-Days You Need to Know About
CVE-2026-96951 is the one to act on immediately. It is a Windows Shell security feature bypass that circumvents Mark of the Web, the protection that flags files downloaded from the internet as potentially unsafe. Attackers can exploit this over a network to execute malicious files without triggering the usual Windows safety warning. Microsoft has confirmed active exploitation in the wild, which means the patch is not optional.
The other two zero-days are publicly disclosed but not yet actively exploited. CVE-2026-108398 allows an attacker to bypass Windows Defender Application Control with no user interaction required; it was discovered by Google Project Zero. CVE-2026-92707 is a MessagePack denial-of-service vulnerability. Both still need patching, but CVE-2026-96951 is the immediate priority.
| CVE | Description | CVSS | Status |
|---|---|---|---|
| CVE-2026-96951 | Windows Shell security feature bypass (Mark of the Web) | 8.8 | Actively exploited |
| CVE-2026-108398 | Windows Defender Application Control bypass (Google Project Zero) | 7.5 | Publicly disclosed |
| CVE-2026-92707 | MessagePack denial-of-service | 6.5 | Publicly disclosed |
Beyond the Zero-Days
This patch cycle also includes Critical Remote Code Execution bugs in Active Directory Domain Services, AD FS, and Azure App Service. If your business uses Microsoft identity infrastructure, on-premises or in the cloud, those patches matter too. The full update also covers Windows 11 24H2, .NET, and Microsoft Office components.
What Australian Businesses Should Do Right Now
- Patch Windows today. There is no workaround for CVE-2026-96951. The patch is the fix. Push Windows Update to all desktops, laptops, and servers this week, not next.
- Check for LTSB 2016 machines. If any device in your environment runs Windows 10 Enterprise LTSB 2016, it is now permanently unpatched. You need an upgrade plan in place before the next vulnerability lands.
- Patch servers too. The Windows Shell vulnerability affects all standard Windows installations, not just workstations. Active Directory, Azure, and .NET environments need updating as well.
- Confirm your managed IT provider's timeline. If you outsource IT, ask your provider to confirm when this update cycle will be deployed across your environment. This month warrants an expedited rollout.
Microsoft Security Response Center Update Guide, Microsoft
Frequently Asked Questions
What is the actively exploited zero-day in October 2026 Patch Tuesday?
CVE-2026-96951 is a Windows Shell security feature bypass that lets attackers circumvent Mark of the Web, the Windows safeguard that flags files downloaded from the internet as potentially unsafe. With this flaw, attackers can bypass that warning over a network and execute malicious files without triggering the usual alert. Microsoft has confirmed active exploitation in the wild, making it the top priority in this update cycle.
Is my Windows 10 machine still supported after this Patch Tuesday?
If you are running Windows 10 Enterprise LTSB 2016, October 2026 is the final security update you will receive. From this point, Microsoft will no longer patch new vulnerabilities, meaning your machines become progressively less secure over time. If you are on this version, you need an upgrade plan urgently. Windows 11 24H2 Home and Pro also received their last update this month.
Do I need to patch servers as well as desktops?
Yes, patch everything. This month's update covers Windows desktops, laptops, and servers. The actively exploited zero-day (CVE-2026-96951) affects the Windows Shell across all standard Windows installations, not just workstations. Active Directory, Azure, and .NET environments also carry Critical-rated patches this month.
How quickly should we apply this month's Windows updates?
Today, if at all possible. With an actively exploited zero-day in this release, patching this week rather than next is the only mitigation available. There is no workaround for CVE-2026-96951; the patch is the fix. If your business uses a managed IT provider, ask them to confirm their deployment timeline for this cycle.
Not Sure If Your Windows Environment Is Up to Date?
All IT Services can audit your patch status, flag end-of-life systems, and take over ongoing update management so you never have to track Patch Tuesday yourself.
Related Guide
Cybersecurity for Sydney SMBs
Explore our complete guide to protecting your business from cyber threats.
Read the Full Guide →