Microsoft’s Largest Patch Tuesday on Record Includes One Actively Exploited Windows Shell Zero-Day (CVE-2026-96951)

Scope: Windows 10, Windows 11, all supported Windows Server versions

Severity: Red

Today’s Microsoft Patch Tuesday fixed a record-breaking 1,411 vulnerabilities, 70 of them critical and 57 of those specifically remote code execution flaws, by far the largest single release Microsoft has shipped. Among the three zero-days patched, one is already being actively exploited: CVE-2026-96951, a command injection flaw in Windows Shell that lets an attacker bypass the Mark of the Web security feature, the mechanism that normally flags a file downloaded from the internet as untrusted and triggers extra warnings before it runs. Microsoft has not disclosed how the flaw is being used in the wild or who reported it, which is typically a sign the exploitation details are still sensitive. Bypassing Mark of the Web is a common early step in malware delivery chains, since many downstream protections depend on that flag being set correctly. Given the sheer scale of this release, Microsoft also introduced a new prioritisation system called risk cohorts this month, grouping related flaws so organisations can triage faster, though the actively exploited Shell bypass should sit above any cohort-based ranking regardless. Organisations must apply the October 2026 cumulative update across all Windows endpoints and servers as a priority, not as part of a routine monthly rollout.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.