Patchday: Attacks on various Windows versions observed

Currently, attackers are targeting Windows 10 and 11, among others, and attacking systems. Two more security vulnerabilities are publicly known, and attacks may be imminent. Windows users must ensure that the Windows Update function is active and that the latest patches are installed.

Patch now!

The exploited vulnerability (CVE-2026-96951 “high”) affects the Windows Shell, and attackers can bypass the Mark-of-the-Web (MotW) security mechanism in an unspecified way. This mechanism marks files downloaded from the internet as such and issues a corresponding warning when opening such a file. The extent to which the attacks are occurring is currently unknown. For such an attack to succeed, however, a victim must cooperate and, for example, open a prepared file attachment in an email sent by an attacker.

Two further vulnerabilities in .NET Framework (CVE-2026-108398 “high”) and in MessagePack-CSharp (CVE-2026-92707 “medium”) are publicly known. Attacks can therefore be imminent. The .NET vulnerability allows attackers to bypass security functions, while the MessagePack vulnerability is suitable for DoS attacks.

Further Dangers

Microsoft Office is threatened by numerous malware vulnerabilities. Some of these are considered “critical” (e.g., CVE-2026-88156). Active Directory, Dynamics 365, and Exchange Server remain vulnerable. Additionally, Windows DHCP and the kernel are also vulnerable. In many cases, attackers can gain higher privileges. In some cases, they even obtain system privileges and thus full control over PCs.

In addition to Windows 10 and 11, various Windows Server editions, such as Windows Server 2016 and Windows Server 2025, are also affected by the security vulnerabilities. Microsoft lists further details on all vulnerabilities closed on this patch day in the Security Update Guide.

(des)