Microsoft distributed its October 2026 Patch Tuesday updates on October 13, according to TurboLab.it. The release was reported to include three zero-days: one described as actively exploited and two as publicly disclosed before patches were available. BleepingComputer and the Zero Day Initiative identify the three CVEs.
The three reported zero-days
- CVE-2026-96951: A Windows Shell security-feature-bypass flaw—one that circumvents a security protection—reported as actively exploited. NHS England Digital also associates the vulnerability with Windows Shell.
- CVE-2026-108398: A .NET Framework security-feature-bypass flaw reported as publicly disclosed before a patch was available. Zero Day Initiative describes its disclosure status.
- CVE-2026-92707: A MessagePack-CSharp denial-of-service flaw also reported as publicly disclosed before a patch was available. Zero Day Initiative identifies the component and vulnerability type.
Microsoft product areas named in the coverage
TurboLab.it listed Windows, Microsoft Office, Exchange Server, SQL Server, Azure services, .NET, Visual Studio and Microsoft Edge among the product areas covered by the October updates. The outlet also referred to other Microsoft products.
What the reported statuses mean for administrators
The active-exploitation report makes CVE-2026-96951 a priority for review. TurboLab.it advised enterprise administrators to assess the updates and deploy them progressively.
