Microsoft has released security updates addressing a record-breaking 1,413 vulnerabilities across its product portfolio. The release includes one actively exploited vulnerability, multiple publicly disclosed vulnerabilities, and over 70 Critical-rated flaws. Notably, an actively exploited Windows Shell vulnerability allows attackers to bypass Mark of the Web (MOTW) protections, potentially enabling the execution of malicious content delivered through phishing emails and malicious links.

Given the volume of vulnerabilities and the presence of active exploitation, organisations should prioritise patch deployment, particularly for internet-facing systems, privileged workstations, and critical infrastructure assets.

Key Statistics

Microsoft addressed:

• 1,413 total vulnerabilities
• 1,102 Windows vulnerabilities
• 134 Microsoft Office vulnerabilities
• 61 Developer Tools vulnerabilities
• 36 SharePoint Server vulnerabilities
• 22 SQL Server vulnerabilities
• More than 670 Privilege Escalation vulnerabilities
• More than 300 Remote Code Execution (RCE) vulnerabilities
• More than 250 Information Disclosure vulnerabilities
• Over 70 Critical-rated vulnerabilities

Most Significant Vulnerabilities

1. CVE-2026-96951 – Windows Shell Security Feature Bypass

CVSS: 8.8
Status: Actively Exploited in the Wild

This vulnerability is a command injection flaw within Windows Shell which can be exploited to bypass Microsoft Mark of the Web (MOTW) protections. Successful exploitation may allow malicious files delivered via email, messaging platforms, or downloaded content to evade security controls designed to warn users before execution.

Attack Scenario

An attacker sends a specially crafted file via email or instant messaging and persuades a user to open it. Exploitation requires user interaction but enables the attacker to bypass MOTW protections.

Risk

• Phishing campaigns
• Initial access attacks
• Malware delivery
• Potential ransomware deployment chains

CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue.

2. CVE-2026-108398 – .NET Framework WDAC Bypass

CVSS: 8.8
Status: Publicly Disclosed

This vulnerability enables a locally authenticated attacker to bypass Windows Defender Application Control (WDAC) restrictions by loading a malicious .NET assembly into a protected process. User interaction is not required.

Potential Impact

• Application whitelisting bypass
• Execution of unauthorised code
• Defence evasion
• Persistence after compromise

This vulnerability is particularly concerning as a post-compromise technique, allowing attackers who already have system access to weaken endpoint security controls.

3. CVE-2026-92707 – MessagePack-CSharp Denial of Service

CVSS: 5.3
Status: Publicly Disclosed

An improperly controlled memory allocation vulnerability in MessagePack-CSharp could enable a remote attacker to trigger denial-of-service conditions.

While not as severe as the actively exploited vulnerabilities, public disclosure may increase exploitation attempts.

4. CVE-2026-21413 – Raw Image Extension RCE

CVSS: 9.8

A heap-based buffer overflow vulnerability affecting Microsoft's Raw Image Extension can lead to remote code execution. An attacker only needs to convince a user to browse to a folder containing a malicious RAW image file. Windows thumbnail generation alone can trigger the vulnerability without opening the image.

Potential Impact

• Remote code execution
• Malware deployment
• Initial access through file shares and removable media
• Workstation compromise

Threat Assessment

The primary concern is CVE-2026-96951, as it is actively exploited and provides a mechanism to bypass MOTW protections frequently relied upon to defend against phishing and malware delivery.

Attackers commonly leverage MOTW bypass techniques to:

• Deliver malware through archives and downloaded files
• Circumvent user security warnings
• Enable follow-on privilege escalation and credential theft activities

The .NET Framework WDAC bypass vulnerability further increases risk by allowing threat actors who have established a foothold to evade application control safeguards and execute unauthorised code.

Recommended Actions

Immediate (0-24 Hours)

1. Prioritise deployment of Microsoft updates addressing:
   • CVE-2026-96951
   • CVE-2026-108398
   • CVE-2026-21413
2. Identify exposed:
   • Windows servers
   • Privileged administration workstations
   • Tier 0 infrastructure
   • Jump hosts
3. Verify WDAC policies remain enforced after patching.