Microsoft Patches Exploited Windows Shell Flaw and Copilot Remote Code Execution

Microsoft released security updates on October 13 addressing an actively exploited Windows Shell security feature bypass, CVE-2026-96951, alongside vulnerabilities in .NET Framework, Windows privilege-management components, and developer tools. CISA added the Shell flaw to its Known Exploited Vulnerabilities catalog, setting an October 16 remediation deadline and requiring forensic triage. Microsoft also patched publicly disclosed CVE-2026-108398, an untrusted search path flaw that lets an authenticated local attacker bypass Windows Defender Application Control by loading a crafted .NET assembly into a protected process; exploitation had not been observed at publication. Three local privilege-escalation flaws—Desktop Window Manager vulnerabilities CVE-2026-69926 and CVE-2026-69880, and Windows Core Messaging vulnerability CVE-2026-69918—can grant SYSTEM privileges and were assessed as more likely to be exploited. Microsoft reported 1,413 Microsoft CVEs in the release, while its product table counted 1,414 vulnerabilities including a republished non-Microsoft CVE.

The release also fixes CVE-2026-103572, an Important-severity remote code execution vulnerability with a CVSS score of 8.8 in the shared Copilot component used by Visual Studio and SQL Server Management Studio. A researcher demonstrated that indirect prompt injection could exploit inconsistent path validation to modify protected configuration files, enabling malicious MCP servers or replacing Visual Studio’s configured search executable; the fix adds path normalization. For Windows Server 2016 and Windows 10 2016 LTSB editions, cumulative update KB5126868 requires servicing stack update KB5126649 and automatically repairs insecure AD FS Distributed Key Manager permissions on Server 2016 associated with CVE-2026-56155. A USB Audio Class 1.0 regression remains partially unresolved. Security teams should prioritize the exploited Shell flaw and required triage, deploy applicable Windows and Copilot fixes, and review update-specific known issues. Free support for the two Windows 10 LTSB editions ended October 13, adding urgency to migration planning as Windows Server 2016 also approaches its support deadline.