Multiple vulnerabilities affecting Microsoft products

Microsoft is a software publisher whose product line, including Windows, .NET Framework and ASP.NET Core, is widely deployed in professional environments. As part of its October 2026 Patch Tuesday, Microsoft fixed 1,411 vulnerabilities, including one actively exploited and two that were publicly disclosed before a patch was made available. These three vulnerabilities are labeled as follows: CVE-2026-96951: This vulnerability is due to improper neutralization of special elements used in a command within Windows Shell. Exploitation of this vulnerability would allow an unauthenticated malicious actor, via the network and after tricking the targeted user into opening a specially crafted file or link, to bypass the Mark of the Web mechanism and obtain processing of content that should have been subject to associated protections. Microsoft indicates that this vulnerability is actively exploited, and it has been listed in CISA's catalog of actively exploited vulnerabilities since October 13, 2026. This vulnerability is classified as high with a severity score of 8.8 according to CVSS v3.1. CVE-2026-108398: This vulnerability arises from an untrusted search path in the .NET Framework. Exploitation of this vulnerability would allow an authenticated attacker with local access to drop a crafted .NET assembly and save it for loading by a protected process, thereby bypassing Windows Defender Application Control restrictions and executing code in the context of that process. This vulnerability is classified as high with a severity score of 8.8 according to CVSS v3.1. CVE-2026-92707: This vulnerability results from poorly controlled sequential memory allocation in MessagePack for C#, a serialization library used in particular by the ASP.NET Core SignalR MessagePack protocol. Exploitation of this vulnerability would allow an unauthenticated malicious actor, by repeatedly sending specially crafted serialized data via the network, to cause excessive memory consumption and a denial of service of the exposed application. This vulnerability is classified as medium with a severity score of 5.3 according to CVSS v3.1.

• CVE-2026-96951: Windows versions with build numbers earlier than the following builds: Windows 10 1607 and Windows Server 2016 (10.0.14393.9612), Windows 10 1809 and Windows Server 2019 (10.0.17763.9376), Windows 10 21H2 (10.0.19044.7807), Windows 10 22H2 (10.0.19045.7807), Windows 11 23H2 (10.0.22631.7652), Windows 11 24H2 (10.0.26100.9711), Windows 11 25H2 (10.0.26200.9711), Windows 11 26H1 (10.0.28000.3231), Windows 11 26H2 (10.0.26300.9711), Windows Server 2012 R2 (6.3.9600.23470) and Windows Server 2025 (10.0.26100.33650), as well as the Outlook.com service, corrected by the publisher;
• CVE-2026-108398: Microsoft .NET Framework 3.5, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 and 4.8.1, on Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025;
• CVE-2026-92707: The Microsoft.AspNetCore.SignalR.Protocols.MessagePack package in versions 8.0.0 to 8.0.31, 9.0.0 to 9.0.20, 10.0.0 to 10.0.12, and 11.0.0-preview.5 to 11.0.0-rc.1, as well as the package MessagePack in versions prior to 2.5.303 and versions 3.0.0 through 3.1.8;

RECOMMENDED ACTIONS:

• Update affected systems by applying Microsoft October 2026 security updates, and verify that workstations and servers reach at least the indicated build numbers;
• Prioritize CVE-2026-96951, actively exploited and listed in the CISA catalog of actively exploited vulnerabilities, whose remediation deadline of October 16, 2026 has passed;
• Update the Microsoft.AspNetCore.SignalR.Protocols.MessagePack package to version 8.0.32, 9.0.21, 10.0.13 or 11.0.0-rc.2 depending on the branch, and the MessagePack package to version 2.5.303 or 3.1.9, then recompile and redeploy the affected applications;
• Plan the migration of editions that have reached their end of support, Windows 11 version 24H2 Home and Pro as well as Windows 10 Enterprise LTSB 2016, for which the October 2026 update is the last released;
• Educate users not to open attachments and links of unknown origin, as circumvention of Mark of the Web relies on action on their part;
• No action required for Outlook.com service, patched by publisher;