Microsoft patches 1,413 flaws, including an exploited Windows zero-day
Microsoft’s October Patch Tuesday addresses 1,413 vulnerabilities across its products, including 1,102 in Windows, according to Rapid7. One Windows Shell flaw, CVE-2026-96951, is already being exploited; it can bypass Windows’ warning for files from the internet, though exploitation requires a user to open a malicious file or visit an attacker-controlled site.
Bottom line — The update also fixes five Outlook flaws that Rapid7 says could be triggered through the reading pane.
Go deeper 7
-
Rapid7 says two other flaws were publicly disclosed: one in .NET Framework and one in MessagePack-CSharp.
-
The .NET Framework flaw requires an attacker to already have a foothold on the system, Rapid7 reports.
-
Rapid7 says scrolling past an email in Outlook’s reading pane could trigger any of five remote-code-execution flaws; some previews may appear without user interaction.
-
The Windows Shell flaw also affected Outlook.com, which Microsoft had patched in an earlier build, according to Rapid7.
-
Windows 11 24H2 Home and Pro reached end of servicing on 13 October, Microsoft’s update notes say.
-
Rapid7 says Windows Server 2012 does not receive a patch for the exploited flaw, while Server 2012 R2 does.
-
Rapid7 reports that Microsoft’s Edge release notes did not yet identify which vulnerabilities recent browser updates had fixed.