Picture your accounts team receiving an email from a "supplier" with an attachment named as the October invoice. A staff member opens it as usual, because Windows shows no special warning.
Files that come from the internet or arrive as email attachments normally carry a label that Windows adds, called Mark of the Web. It tells the system the file came from outside, so Windows can show a warning and Office can block macros. The flaw Microsoft fixed this month lets attackers get around that label, and it is already being used in real attacks.
What happened
On 13 October 2026, Microsoft released its monthly security updates (Patch Tuesday). This round fixes more than 1,400 vulnerabilities. Tenable counted 1,407; BleepingComputer counted 1,411, not including 348 fixed earlier in the month. The numbers differ by counting method, but both sources agree this release is unusually large.
The one to look at first is CVE-2026-96951 in Windows Shell. Microsoft's Security Update Guide states that:
- It has been exploited (Exploitation Detected), though it was not publicly disclosed before the fix.
- Its CVSS 3.1 base score is 8.8, rated Important.
- An attacker who exploits it can evade Mark of the Web defenses.
- The attack works by sending a specially crafted file by email or instant message, or by enticing the user to click a link to the attacker's site. The attacker cannot force the user to open it; the user has to take action.
On the same day, CISA, the US cybersecurity agency, added CVE-2026-96951 to its Known Exploited Vulnerabilities catalog and set 16 October 2026 as the fix deadline for US federal agencies. That deadline does not bind Thai businesses, but it shows how urgent security agencies consider this.
The other item worth knowing is CVE-2026-108398 in .NET Framework, which was publicly disclosed before a patch existed. It lets an attacker who already has access to a machine bypass Windows Defender Application Control (WDAC) and run unauthorized applications. Microsoft says it has not seen exploitation.
Why it matters for Thai businesses
Email attachments remain a main way attackers get into companies: fake invoices, quotations and job applications. Many businesses rely on Windows warnings and Office macro blocking as the last check before staff open a file. Microsoft's documentation explains that Office decides whether to block macros in files from the internet largely by looking at Mark of the Web. If that label can be evaded, that check gets weaker at once.
Many IT teams patch on a monthly cycle, or wait two or three weeks for others to test first. That is reasonable for routine fixes. For a flaw that is already being exploited, the waiting period is exactly when company machines are exposed.
Another gap is machines that no longer get updates. Microsoft states that the October 2026 update is the last one for Windows 11 version 24H2 Home and Pro. We covered this in our Windows 11 24H2 lifecycle article. Those machines receive this fix, but they will not receive next month's.
