Which October 2026 flaw should be patched first?

CVE-2026-96951, a Windows Shell flaw that Microsoft marks “Exploitation Detected”. It lets an unauthenticated attacker bypass a security feature over the network, with user interaction, and scores 8.8 on CVSS 3.1. CISA added it to its KEV catalog on October 13, 2026, with an October 16 due date for US federal agencies.

Why is a flaw rated “Important” the priority?

Because Microsoft's rating measures technical impact, not exploitation. A Mark of the Web bypass removes the warning that protects a user opening a file from the internet, often the first step of a successful phishing attack. Exploited and reachable through a file or a link, it comes before “Critical” flaws that no attacker uses yet.

What about the two publicly disclosed flaws?

Microsoft lists CVE-2026-108398, a security feature bypass in .NET Framework, and CVE-2026-92707, a denial of service in MessagePack-CSharp, as public before the fix, with no known exploitation. The technical details are available, so handle them in the normal cycle but without waiting for next month, starting with the machines that run .NET applications.

Analysis · Exposure

October 2026 Patch Tuesday: an exploited Windows flaw

On October 13, 2026, Microsoft fixed an exploited Windows Shell flaw that bypasses Mark of the Web. What to patch first, how to prove it, and the MSP angle.

By Sentrix · Published 2026-10-14

On October 13, 2026, Microsoft released its monthly security updates. The October document lists more than 1,400 new entries across all product families. Only one is marked as exploited: a Windows Shell flaw that bypasses a protection many users no longer even notice.

What the bulletins say

Microsoft, CVE-2026-96951. The Security Response Center entry describes a "Windows Shell Security Feature Bypass Vulnerability": "Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network." It scores 8.8 on CVSS 3.1, network vector, no privileges required, user interaction required. Microsoft rates it "Important" and marks it "Exploitation Detected".

Two flaws public before the fix. The same release marks as publicly disclosed CVE-2026-108398, a security feature bypass in .NET Framework, and CVE-2026-92707, a denial of service in MessagePack-CSharp. Neither is reported as exploited.

CISA. CVE-2026-96951 has been in the KEV catalog since October 13, 2026, with an October 16 due date for US federal civilian agencies.

Why it matters

The size of a Patch Tuesday says little about risk. A month with more than 1,400 entries invites one batch at one pace for everything, which is exactly the mistake: a single line of that batch is already in attackers' hands.

That line targets a quiet mechanism. Mark of the Web is the tag Windows puts on a file that came from the internet; it triggers the warning before opening, or Office's protected view. A bypass does not hand over a machine on its own: it removes the last signal that would have made a user hesitate before a booby-trapped attachment or download. That is why an "Important" rating can be more urgent than a "Critical" one.

And the required user interaction does not protect a mid-sized organisation. A well-crafted email and one busy person are enough.

What we think at Sentrix

A Patch Tuesday runs at two speeds:

The fast lane: what is exploited. CVE-2026-96951 first, on every Windows workstation and server, with the KEV due date as the target: days, not the monthly cycle. Our article on prioritizing patches with the KEV catalog sets out the method.
The normal lane: the rest, starting with what is public (the .NET and MessagePack-CSharp flaws), then what faces the internet.
Proof, not intent. A patch "deployed" in the console is not a patch installed. Measure the real installation rate per group of machines and the list of machines behind. That is the inventory the continuous exposure (CTEM) module keeps current.
Defences around the flaw. Until the whole fleet is patched, strengthen what the flaw bypasses: attachment filtering, blocked risky file types, and phishing-resistant MFA so stolen credentials are not enough (our guide).

For an MSP or an MSSP, the issue is measurement per client. The same flaw hits every fleet; what differs is the delay. A per-client view with the installation rate of CVE-2026-96951 and its date is what your clients and their auditors expect. Our vulnerability and patch management service works the same way.

The next step

This week, pull the list of Windows machines that have not yet installed the October update, sorted by exposure: the teams that receive the most outside email first. Set an end date a few days out and track it. If you want to run the exercise with us, contact us.

Sources

Frequently asked questions

Which October 2026 flaw should be patched first?: CVE-2026-96951, a Windows Shell flaw that Microsoft marks “Exploitation Detected”. It lets an unauthenticated attacker bypass a security feature over the network, with user interaction, and scores 8.8 on CVSS 3.1. CISA added it to its KEV catalog on October 13, 2026, with an October 16 due date for US federal agencies.
Why is a flaw rated “Important” the priority?: Because Microsoft's rating measures technical impact, not exploitation. A Mark of the Web bypass removes the warning that protects a user opening a file from the internet, often the first step of a successful phishing attack. Exploited and reachable through a file or a link, it comes before “Critical” flaws that no attacker uses yet.
What about the two publicly disclosed flaws?: Microsoft lists CVE-2026-108398, a security feature bypass in .NET Framework, and CVE-2026-92707, a denial of service in MessagePack-CSharp, as public before the fix, with no known exploitation. The technical details are available, so handle them in the normal cycle but without waiting for next month, starting with the machines that run .NET applications.

Let's talk about your compliance program.

Contact us