1-minute read
What a defender needs to know
The October 13 Windows updates address an exploited Shell bypass, CVE-2026-96951. CrowdStrike reports that a user must open or click a crafted delivered file; successful exploitation bypasses Mark of the Web protections used for SmartScreen warnings and Office Protected View. The Microsoft-assigned CVE record lists the affected Windows branches and carries a CISA known-exploited entry. The same release includes publicly disclosed flaws with different conditions and many other updates.
Windows DHCP Server also needs attention. Its Microsoft-assigned record describes unauthenticated network code execution through a use-after-free in CVE-2026-96934. Identify Windows hosts running DHCP and the network segments that can reach them on UDP/67; deploy the October security update. For Server 2022, verify an installed build at or above 10.0.20348.5761; for Server 2025, at or above 10.0.26100.33650. For Windows 11 24H2 and 25H2 endpoints, compare installed builds with the Shell thresholds 10.0.26100.9711 and 10.0.26200.9711. Check the product-specific record for other branches. A successful deployment job is useful only when the installed build crosses its affected-version floor.
CrowdStrike labels CVE-2026-21413 a Windows image-extension issue; its Talos-assigned CVE record identifies LibRaw. Confirm the correct Windows advisory and Store extension version before targeting a rollout with that ID.