Microsoft update includes exploited Windows Shell flaw

Microsoft’s October 2026 security update includes a Windows Shell vulnerability the company says attackers are exploiting, alongside one of its largest monthly releases of security fixes. Microsoft released the update on October 13, with reports counting either 1,413 vulnerabilities addressed or 1,417 Microsoft-assigned CVEs, depending on the scope used. The exploited flaw, CVE-2026-96951, bypasses Mark of the Web protections, which help Windows identify files downloaded from the internet. Microsoft marked the vulnerability as exploited in the wild. Reports say the bypass can allow malicious files to evade security checks that rely on the marker. Details about the attacks were limited in the supplied reporting. The release affects products across Microsoft’s portfolio. One breakdown counted 1,102 Windows flaws, 134 in Office applications, 61 in developer tools, 36 in SharePoint Server, 22 in SQL Server, 15 in Azure and seven in Exchange Server. Another breakdown also listed four Defender flaws and vulnerabilities in additional categories.