Microsoft’s October 2026 Patch Tuesday addresses over 1,000 security flaws, including one actively exploited zero-day vulnerability and two publicly disclosed vulnerabilities.
The zero-day vulnerability is CVE-2026-96951, a Windows Shell security feature bypass that allows attackers to circumvent the Mark of the Web security feature, which helps Windows identify files downloaded from the internet.
Microsoft warns that the vulnerability involves improper handling of special elements in commands, potentially allowing unauthorized attackers to bypass a security feature over a network. The company has not shared details about the attacks.
Two publicly disclosed vulnerabilities are CVE-2026-108398, a .NET Framework security feature bypass that could allow unauthorized applications to run, and the second is CVE-2026-92707, a MessagePack-CSharp denial of service issue that could affect service availability.
Meanwhile, Fortinet released security advisories addressing over a dozen security vulnerabilities, including a high-severity flaw in FortiSIEM. Tracked as CVE-2026-106173, the vulnerability is a path traversal issue that allows a remote non-authenticated attacker to execute arbitrary code.
Also, Ivanti has disclosed an actively exploited zero-day vulnerability in its Connect Secure (ICS) remote access gateway that could allow attackers to run commands on affected systems. Tracked as CVE-2026-104935, the flaw allows remote attackers to bypass authentication without needing user interaction or special access. It affects several ICS versions, including 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier.