Affected Systems

Microsoft Windows (all supported versions), .NET Framework, and MessagePack-CSharp. Notably, Windows 11 24H2 Home/Pro and Windows 10 Enterprise LTSB 2016 reached end of support October 13, 2026. Three zero-days: CVE-2026-96951 (actively exploited Windows Shell Mark of the Web bypass), CVE-2026-108398 (publicly disclosed .NET WDAC bypass), CVE-2026-92707 (publicly disclosed MessagePack-CSharp DoS).

Exploitation Status

CVE-2026-96951 is actively exploited in the wild (no attack details disclosed). CVE-2026-108398 and CVE-2026-92707 are publicly disclosed but no evidence of active exploitation. No PoC availability mentioned for any of the three zero-days.

Business Impact

The actively exploited CVE-2026-96951 allows attackers to bypass Mark of the Web protections via command injection, enabling execution of malicious files without security warnings—critical for phishing and malware delivery chains. CVE-2026-108398 permits authenticated attackers to bypass Windows Defender Application Control (WDAC), undermining application whitelisting defenses. CVE-2026-92707 enables network-based denial of service against .NET applications using MessagePack-CSharp. The record patch volume (1,411 flaws) significantly increases testing and deployment workload for IT teams. End of support for Windows 11 24H2 Home/Pro and Windows 10 Enterprise LTSB 2016 creates immediate migration pressure.

Urgency

🔴 Immediate

Recommended Actions

  • Deploy October 2026 Patch Tuesday updates immediately, prioritizing systems exposed to untrusted content or internet-facing (CVE-2026-96951 actively exploited)
  • Audit and migrate systems running Windows 11 24H2 Home/Pro and Windows 10 Enterprise LTSB 2016 to supported versions—no further security updates available
  • Review Windows Defender Application Control (WDAC) policies and monitor for unauthorized .NET assembly registration or protected process anomalies (CVE-2026-108398)
  • Identify applications using MessagePack-CSharp library and apply patches or implement rate limiting to mitigate DoS risk (CVE-2026-92707)
  • Monitor for Mark of the Web bypass indicators: execution of files from internet zones without expected security prompts, unusual Windows Shell command injection patterns