A Windows file opened from a message or download can slip past the warning that normally accompanies internet-sourced content. The October 13 security updates address that exploited Windows Shell flaw, CVE-2026-96951, alongside a separate unauthenticated code-execution flaw in Windows DHCP Server. Endpoint teams and the people who run DHCP have different jobs in this patch cycle: the Shell attack needs a person to act on a crafted file; the DHCP flaw needs network reach to a vulnerable service.
CrowdStrike’s October Patch Tuesday analysis says Microsoft addressed 1,413 vulnerabilities, including 75 rated Critical. Its specific assessment is “one exploited zero-day vulnerability, two publicly disclosed zero-day vulnerabilities.” The Microsoft-assigned Shell CVE record describes a command-injection security-feature bypass, and the same record carries a CISA known-exploited-vulnerabilities entry dated October 13. Treat the exploited Shell issue as a distinct priority within the much larger release; the two publicly disclosed flaws have different attack conditions.
A click without the warning
Mark of the Web (MOTW) labels files that came from outside the machine. Windows uses that origin information when deciding whether to show SmartScreen warnings and when Office opens a document in Protected View. CrowdStrike says an attacker can deliver a specially crafted file through email, a message or a web download; the user must open or click it. Exploitation of CVE-2026-96951 bypasses the origin-based protections, reducing the warning friction before the file’s contents run.
Another October risk has a different trigger: CrowdStrike identifies five Critical Outlook remote-code-execution flaws and says the Reading Pane is an attack vector for CVE-2026-70291 and CVE-2026-88156. It also describes Preview Pane exposure across Office file parsers. Patch the Office applications deployed on workstations that handle external attachments; the cited Outlook flaws can run when a message is viewed in the Reading Pane.
The Shell record lists affected Windows client and server releases. For example, its affected range for Windows 11 24H2 ends before build 10.0.26100.9711; for Windows 11 25H2 it ends before 10.0.26200.9711. The same record lists Windows Server 2022 builds before 10.0.20348.5761. Check other October CVEs against their own affected-product tables. Match each machine’s edition and installed build to the record’s affected-product table.
DHCP servers face a separate route
A DHCP server has to accept address requests from the network segments it serves. That makes a vulnerable server an attractive target once an attacker has access to one of those segments. Microsoft’s CVE-2026-96934 record describes a use-after-free in Windows DHCP Server that allows an unauthorized attacker to execute code over a network. The record scores it 9.8 under CVSS 3.1 with no required privileges or user interaction. CrowdStrike says the service listens on UDP/67; the DHCP issue calls for a service inventory and a patch check on Windows DHCP hosts, including servers reached through relay paths.
Microsoft lists Windows Server 2016 builds before 10.0.14393.9612, Server 2019 builds before 10.0.17763.9376, Server 2022 builds before 10.0.20348.5761, and Server 2025 builds before 10.0.26100.33650 as affected for this DHCP CVE. Its record also includes older Server 2012 and 2012 R2 ranges. Identify the actual OS branch and DHCP role before comparing the build, and use the affected-product list for older branches. Keep the other October server fixes in the deployment plan too.
CrowdStrike calls CVE-2026-21413 a Windows Raw Image Extension flaw, while the CVE record assigned by Cisco Talos identifies LibRaw. Verify the correct Windows advisory and the installed Store extension version before using that ID to target a Windows image-extension rollout.
Confirm the build on each host
Deploy the October Windows security updates to affected endpoints and the Windows DHCP servers you actually operate. On representative Windows 11 24H2 and 25H2 endpoints, compare the installed OS build with the Shell record’s 10.0.26100.9711 and 10.0.26200.9711 thresholds, respectively. On Windows DHCP Server 2022 and 2025 hosts, compare the installed build with 10.0.20348.5761 and 10.0.26100.33650, respectively. Check the relevant record for other branches and verify that the server role and reachable UDP/67 paths match your inventory. If deployment tooling reports success but the installed build is still below its product-specific floor, the machine still needs the update.
For a suspected Shell incident, investigate delivery and file-opening activity on the affected endpoint alongside your available endpoint telemetry while Microsoft and defenders develop CVE-specific detection guidance. Check the installed build even when automatic updates are enabled. A patched build verifies that the listed vulnerability’s affected range has been exited. Investigate suspicious files delivered before the update as a separate incident-response task.