Microsoft’s October 2026 security updates fix a Windows Shell flaw that attackers were already exploiting, but administrators also have a fresh deployment problem to test: the Windows 11 cumulative update can prevent some non-admin users from connecting through Remote Desktop.
The updates arrived October 13 and address more than 1,400 vulnerabilities across Microsoft products, depending on how third-party trackers count CVEs published during the release window. The urgent item is CVE-2026-96951, an important-severity Windows Shell security-feature bypass that Microsoft lists as exploited in the wild. Microsoft has not publicly described the attacks or identified affected victims.
For Windows 11 versions 24H2, 25H2 and 26H2, the main cumulative package is KB5127648, which moves supported systems to OS builds 26100.9711, 26200.9711 or 26300.9711. Organizations should move quickly on the exploited flaw, while using a test ring that includes Remote Desktop hosts and standard user accounts.
The exploited flaw weakens a downloaded-file warning layer
CVE-2026-96951 affects Windows Shell and can bypass a security feature through command injection over a network, according to Microsoft’s advisory. Independent summaries from BleepingComputer and SecurityWeek identify the bypassed control as Mark of the Web.
Mark of the Web is the zone information Windows attaches to many files downloaded from the internet. Windows, Microsoft Office, SmartScreen and other defenses can use that marker to show warnings or apply stricter handling. A bypass does not automatically give an attacker full control of a PC, but it can remove a layer that helps users and security products recognize untrusted content. That makes the flaw useful as part of a larger phishing or malware chain.
Microsoft rates the vulnerability 8.8 out of 10 and says exploitation has been detected. With no public attack-chain details or reliable indicators of compromise, defenders should not wait for a narrowly targeted hunting rule. The practical response is to deploy the cumulative update and continue treating unexpected attachments, archive files, shortcuts and downloaded scripts as untrusted even when Windows does not display the usual warning.
Remote Desktop is the rollout complication
Microsoft added a known issue to the KB5127648 release notes on October 14. Non-admin users may fail to connect to Remote Desktop hosts when Administrator protection is enabled. Affected attempts return error 0xC000000D and the message “The token that was passed to the function is invalid.”
The problem began with the September 2026 preview update and remains present in later releases, including October’s security package. It primarily affects enterprise-managed Windows 11 devices used as Remote Desktop hosts. Microsoft notes that Administrator protection is enabled by default in its Windows 11 versions 24H2, 25H2 and 26H2 security baselines unless an organization changed that policy.
Microsoft’s temporary mitigation is to turn off Administrator protection by resetting the User Account Control: Type of Admin Approval Mode policy through Intune or Group Policy. That is a security tradeoff, not a routine troubleshooting step. Teams that depend on RDP should first reproduce the failure in a controlled group and decide whether the affected workflow is important enough to justify temporarily weakening that protection. Microsoft is working on a future fix.
What else deserves attention in this release
The unusually large release contains 70 vulnerabilities rated critical in BleepingComputer’s count, including 57 remote-code-execution flaws. Microsoft’s published list includes critical issues in Windows DHCP Server, Microsoft Word, .NET and Exchange Server, alongside hundreds of elevation-of-privilege, information-disclosure and denial-of-service bugs.
Two other vulnerabilities qualify as zero-days because information was public before fixes were available. CVE-2026-108398 is a .NET Framework search-path flaw that can let an authenticated attacker place a crafted assembly and bypass Windows Defender Application Control. CVE-2026-92707 is a network-reachable denial-of-service flaw in MessagePack-CSharp. Microsoft has not marked either one as exploited.
The Windows 11 update also starts default auditing for ReFS volumes on externally attached storage. Enforcement remains disabled so administrators can evaluate compatibility before Microsoft enables the hardening by default in 2027. The same package fixes earlier problems involving Explorer crashes in some multi-user environments, Always On VPN connections, tiered Storage Spaces Direct disks, printing, fingerprint sign-in and game mouse input.
A practical October patch order
- Identify supported Windows versions. Windows 11 24H2 Home and Pro received their final update this month. Those PCs need an upgrade to a supported release, not merely confirmation that KB5127648 installed.
- Patch a representative pilot ring immediately. Include normal employee laptops, privileged workstations, Remote Desktop hosts, devices managed with Microsoft’s security baseline and systems using business-critical Office or .NET applications.
- Test RDP with standard accounts. An administrator account succeeding does not clear the known issue. Test the same non-admin roles and connection paths used in production, and record whether Administrator protection is enabled.
- Expand endpoint deployment quickly. The actively exploited Shell bypass makes a long holdback difficult to justify. Separate the general workstation rollout from any smaller group of RDP hosts that requires additional testing.
- Prioritize exposed server roles. Inventory DHCP Server, Exchange, .NET services, SharePoint and other affected Microsoft components. Apply the product-specific update and restart guidance rather than assuming Windows Update covers every server application.
- Verify build numbers and failures. For the main Windows 11 package, look for builds ending in
.9711. Track RDP error0xC000000D, application failures and update rollback rates through the first deployment waves. - Preserve layered download defenses. Continue email filtering, attachment sandboxing, application control and endpoint detection. Patching the exploited bypass closes the known hole; it does not make downloaded files trustworthy.
Do not let the record count obscure the deployment decision
Security vendors report totals of 1,411 or 1,413 vulnerabilities because their counting rules differ, and Microsoft’s release also includes CVEs published earlier in the month. For administrators, the exact record is less useful than the order of operations: close the exploited Shell bypass, test Remote Desktop with non-admin users, upgrade Windows editions that have reached end of support and then work through exposed server roles.
The October release is large enough that broad testing still matters. The active exploitation means that testing has to be fast, focused and paired with a clear decision for the RDP-affected group rather than used as a reason to delay the entire fleet.
