■ CISCO CVE-2026-76519 · Fixed■ CITRIX CVE-2026-88779 · Fixed■ FORTINET CVE-2026-104286 · Fixed■ MICROSOFT KB5127648 · Fixed in October 13 updates■ ORACLE · Pending Oct 20 CPU (pre-release)■ PALO ALTO CVE-2026-0322 · Fixed■ SAP GHSA-4mv3-jxxm-9cx2 · Patches released 2026-10-13■ VMWARE/BROADCOM KB 455737 · No critical release in October■ MICROSOFT KB5124010 · Mitigated (workaround only

← All impacts

Microsoft

Microsoft October 2026 Patch Tuesday: exploited Windows Shell MotW bypass (CVE-2026-96951)

Fixed

TL;DR: Microsoft's October 13 updates fix CVE-2026-96951, a Windows Shell security feature bypass that Microsoft marks Exploited: Yes. CISA added it to KEV on 2026-10-13. (MSRC, KEV)

Critical / exploited fix

Item Detail Source
CVE CVE-2026-96951, Windows Shell Security Feature Bypass (CWE-77) MSRC
Severity Max severity Important; CVSS 3.1 8.8 / 8.2 MSRC
Exploitation Publicly disclosed: No. Exploited: Yes ("Exploitation Detected") MSRC
What it bypasses Mark of the Web (MOTW); delivered via a crafted file in an email or IM attack scenario, so the user has to take an action MSRC
Affected / fixed Windows 10, Windows 11 (23H2–26H2), and Server 2012 R2–2025. Example fixed builds: Win 11 24H2 10.0.26100.9711, 25H2 10.0.26200.9711, 26H2 10.0.26300.9711; Server 2025 10.0.26100.33650 MSRC
Windows 11 KB KB5127648 (OS Builds 26300.9711, 26200.9711, 26100.9711) KB5127648
KEV dateAdded 2026-10-13, dueDate 2026-10-16, ransomware use Unknown KEV

Post-install impact

  • Known issue (vendor-confirmed): Remote Desktop failures for non-admin users. See windows-11-rdp-0xc000000d-admin-protection.md.
  • Behaviour change (documented, added Oct 15): KB5127648 changes the default for NTLMv1-derived SSO credentials from Audit to Enforce when BlockNtlmv1SSO isn't set and Credential Guard is disabled. Microsoft says this "might affect Wi-Fi, Ethernet, and VPN connections that use MS-CHAPv2-based authentication." (KB5127648)
  • Press: BleepingComputer covered the black-screen fix and noted Microsoft confirmed the RDP issue. (BleepingComputer)
  • Fixed by this update: the black-screen/desktop-loading issue (primarily AVD with FSLogix) and the AC-3 app crashes. (Release health)

Should you hold the patch?

MoonSec analysis: No. The update fixes an exploited bug and is due in KEV by Oct 16. Test RDP hosts (see the linked RDP entry) and MS-CHAPv2 Wi-Fi/VPN, in your first ring.

Last verified 2026-10-15Report an error: contact@moonsec.ai