Microsoft Patch Tuesday Oct. 2026: CVE-2026-96951 Exploited

I noticed unusually large numbers in Microsoft's patch announcement released on Oct. 13, 2026, so I pulled the CVRF file from the MSRC API and went through it myself, rather than relying on secondhand reporting, then pulled together the parts that Windows Server administrators need to make decisions about.

The heading of the MSRC release notes says this release contains 1,474 Microsoft CVEs and republishes another 753 CVEs from other vendors. That figure differs from my own counts in two places. The product group table on the same page adds up to 1,454 (including the Defender row with 4 and Other with 35, which I left out of the table below; Edge is 0), and the CVRF file retrieved on Nov. 5 (last revised Nov. 4) contains 1,475 entries whose numbering authority (CNA) is Microsoft. I therefore use MSRC's stated 1,474 as the main figure and the table only as an overview.

The actively exploited vulnerability: CVE-2026-96951

This is a command injection vulnerability (CWE-77) in Windows Shell that bypasses Mark of the Web (MOTW) protection. MOTW is a marker Windows attaches to files from the internet or email so that SmartScreen and Protected View can warn before opening them. Once it is bypassed, an attacker-supplied file opens without a warning.

MSRC assigns a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), and NVD gives it the same base score. Microsoft rates it Important, and the exploitability field says Exploitation Detected. CISA added it to KEV on Oct. 13 with a due date of Oct. 16. The ransomware field says Unknown, and CISA sets forensic triage to Yes.

In practice, this vulnerability requires someone to open a file (UI:R). It is not a worm that can get into a machine on its own. But a Windows Server machine where people connect over RDP to work and open files or email meets the conditions exactly. The Server versions listed for fixes are 2012 R2, 2016, 2019, 2022, and 2025 (Server 2012 is not listed for this CVE). MSRC added Edge (version 154.0.4258.62) to this CVE's update list in its Oct. 26 revision.

To check which files carry the MOTW marker, look at the alternate data stream.

# ไฟล์ที่ดาวน์โหลดมาจะมี stream ชื่อ Zone.Identifier (ZoneId=3 คือ Internet)
Get-Content -Path .\setup.zip -Stream Zone.Identifier

Unauthenticated Critical vulnerabilities I checked by server role

Counting only the Windows Server products themselves in the CVRF (Nov. 4 revision), I found 36 Critical entries for Server 2025, 34 for Server 2022, 31 for Server 2019, 27 for Server 2016, 24 for Server 2012 R2, and 22 for Server 2012 (including add-ons such as HEVC Video Extensions would add one or two entries, so treat these as approximate figures). None were being exploited at the time of the announcement, and Microsoft assesses every vulnerability below as Exploitation Less Likely. The ones with CVSS 9.8 that can be exploited over the network without authentication or user interaction are:

MSMQ, DHCP Server, and print services are not enabled on every machine. First check which machines actually run those roles. Machines that do, and that are accessible from untrusted networks, should be patched first.

Get-WindowsFeature -Name DHCP, MSMQ-Server, Print-Services | Format-Table Name, InstallState
Get-Service -Name DHCPServer, MSMQ, Spooler -ErrorAction SilentlyContinue | Format-Table Name, Status

In its Oct. 13 blog post on risk cohorts, MSRC says that grouping CVEs does not replace checking for highly severe or actively exploited vulnerabilities, which matches the order I set out above.

Affected versions and required KBs

These are cumulative updates that include earlier patches, so installing the latest one covers them. The build numbers below are the "fixed versions" listed in the CVRF.

The .NET Framework vulnerability CVE-2026-108398 (WDAC bypass, Publicly disclosed, not yet exploited) requires a separate .NET package. For example, Server 2022 running .NET 4.8 uses KB5127687 (4.8.1 uses KB5127693), and Server 2019 running .NET 4.6.2 through 4.7.2 uses KB5127666. For .NET 4.8 on 1809/Server 2019, the CVRF lists KB5127685 under Windows 10 version 1809; check Microsoft Update Catalog to confirm that this package applies to Server 2019. I found no Server 2016 entry in the CVRF for this CVE, so check the CVE page itself for any additional updates required.

Server 2022 also has a lifecycle change. Its KB page says the Oct. update is the last in mainstream support, after which extended support provides security updates through Oct. 14, 2031. The Server 2019 KB page says support ends in Jan. 2029.

How to install and verify

1. Back up first Take a snapshot or backup of machines with important roles (DC, DHCP, Exchange, SharePoint), then choose 1-2 machines to test first.
2. Check the servicing stack The KB5126655 page says the SSU for 2022 is KB5126654 and must be installed first. The KB5126646 page lists KB5126645 as the SSU for 2025. Open the KB page for your version to check whether it needs a separate installation.
3. Install the cumulative update Through Windows Update, WSUS, or an .msu file from Microsoft Update Catalog.
4. Restart, then check the build With the script below. Do not rely only on an installation success message.

If installing with an .msu file from Catalog:

# เปลี่ยนชื่อไฟล์ให้ตรงกับที่โหลดมา
wusa.exe C:\updates\windows-kb5126655-x64.msu /quiet /norestart

Check that the build matches the table above (for Windows Server only, because Windows 11 uses a different set of build numbers).

$cv  = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
$min = @{ '9200' = 26434; '9600' = 23470; '14393' = 9612; '17763' = 9376; '20348' = 5761; '26100' = 33650 }
$b = [string]$cv.CurrentBuildNumber
if ($min.ContainsKey($b) -and $cv.UBR -ge $min[$b]) { "OK  $b.$($cv.UBR)" } else { "WARN  $b.$($cv.UBR) ยังต่ำกว่า October 2026" }

On WSUS, approve the updates for the test group first, then expand deployment (the group name Pilot is an example).

Get-WsusUpdate -Classification Security -Approval Unapproved |
  Where-Object { $_.Update.Title -like '*KB5126655*' } |
  Approve-WsusUpdate -Action Install -TargetGroupName 'Pilot'

Several KB pages carry the same note: after installing KB5070884 or later, WSUS no longer displays error details during sync. Microsoft temporarily removed them to address CVE-2025-59287. If sync fails, check the WSUS log files on the WSUS machine itself.

Check whether you have been compromised

Microsoft has not published IOCs for CVE-2026-96951, and details of the actual attacks were not disclosed in the sources I read, so I have no list to search against. CISA has flagged forensic triage as Yes in this CVE's KEV entry, which means you should also investigate past activity, rather than just apply the patch. My own approach is a heuristic, not an official IOC: check EDR or Sysmon for cmd.exe or powershell.exe launched by Explorer or an archive extraction program on machines where people frequently open files, during the period before patching.

For my own systems, I would patch machines where people use RDP to open files or check email on the Server within 7 days. DHCP, MSMQ, or print servers accessible from untrusted networks would go in the same first batch. Machines where nobody opens files and none of those roles are present can wait for a maintenance window, depending on each site's readiness, but should not be postponed into the next month.

P.S. Remember that Server 2022 has moved into extended support with this release. If you have been planning a version migration, it is time to start putting a firm schedule together.

Sources: Microsoft MSRC CVRF for Oct. 2026 (https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-Oct), Microsoft Security Update Guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951), MSRC blog "Using risk cohorts to prioritize security updates" (https://www.microsoft.com/en-us/msrc/blog/2026/10/using-risk-cohorts-to-prioritize-security-updates), Microsoft Support KB5126655 (https://support.microsoft.com/help/5126655), KB5126646 (https://support.microsoft.com/help/5126646), KB5126651 (https://support.microsoft.com/help/5126651), CISA KEV (https://www.cisa.gov/known-exploited-vulnerabilities-catalog), NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-96951). Information current as of Nov. 5, 2026. I will come back and update this later.