Microsoft Patches Exploited Windows Shell Flaw as Windows 11 24H2 Home and Pro Support Ends
Active Exploitation · 22 sources · Updated 9d ago · First seen Oct 13, 2026
Microsoft’s October 2026 Patch Tuesday addresses more than 1,100 vulnerabilities, including an actively exploited Windows Shell security feature bypass, CVE-2026-96951, rated Important. Published totals differ: SANS-linked reporting and CSIRT Panamá list 1,417 vulnerabilities, while other reports cite 1,411 or 1,118. SANS-linked reporting identifies 76 critical flaws, including seven requiring no customer action. CSIRT Panamá also identifies publicly disclosed vulnerabilities in .NET Framework (CVE-2026-108398) and MessagePack-CSharp (CVE-2026-92707). Microsoft introduced 15 provisional customer-risk cohorts to group vulnerabilities by shared exposure-assessment questions, with the largest covering filesystems and storage, Office and mail clients, and graphics and media processing. These exploratory groupings do not replace individual assessments, exploitation checks, or patching instructions; security teams should prioritize the exploited flaw and consult Microsoft’s Security Update Guide for affected products and remediation.
Windows 11 update KB5127648 delivers security and reliability fixes for versions 24H2, 25H2, and 26H2, including File Explorer preview protections against NTLM hash leakage, Active Directory domain-trust fixes, and Sysmon tampering-detection improvements. Windows 10 update KB5126657 brings applicable security fixes to eligible Enterprise LTSC and Extended Security Updates devices, adds ReFS auditing controls, and continues Secure Boot certificate deployment; some USB Audio Class 1.0 issues remain unresolved. Both update streams include backup or storage fixes. Windows 11 24H2 Home and Pro and Windows 10 Enterprise LTSB 2016 also reached the end of updates, making migration a priority; Windows 11 24H2 Enterprise and Education remain supported until October 12, 2027. Administrators should deploy applicable updates through centralized management, verify Secure Boot certificate replacement, and move unsupported devices to supported releases.
