Signal is active with 5 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
The three zero-days patched in Microsoft's October Patch Tuesday are: 🔥 CVE-2026-96951 – Actively exploited Windows Shell flaw lets attackers bypass Mark of the Web protections. ⚠️ CVE-2026-108398 – Publicly disclosed .NET Framework flaw allows attackers to bypass Windows Defender Application Control (WDAC). ⚠️ CVE-2026-92707 – Publicly disclosed MessagePack-CSharp flaw allows denial-of-service attacks.
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108398 I see you, @tiraniddo 👀
#windowsupdate #microsoft ■注目の CVE CVE ID／タイトル／重要な項目 ・CVE-2026-96951 Windows Shell のセキュリティ機能のバイパスの脆弱性 悪用が検出されています ・CVE-2026-108398 .NET Framework のセキュリティ機能のバイパスの脆弱性 公表済み https://x.com/kawn2020/status/2110197317798400407
Microsoft also flags a publicly disclosed .NET Framework vulnerability, CVE-2026-108398.
October Patch Tuesday, my order: 1. CVE-2026-96951, Windows Shell MotW bypass. Exploited. Endpoints today. 2. CVE-2026-70229, AD DS RCE, critical. DCs next. 3. CVE-2026-108398, .NET WDAC bypass, already public. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951 https://t.co/nfTj87IRFL
#NØØT_Security_Alerts 🚨 #ALERT — MICROSOFT .NET FRAMEWORK FLAW CAN BYPASS WINDOWS APPLICATION CONTROL October 13, 2026 DISCLOSED BY: Microsoft Security Response Center REPORTED BY: James Forshaw, Google Project Zero PRODUCT: Microsoft .NET Framework CVE: CVE-2026-108398 SEVERITY: HIGH — CVSS 8.8 AFFECTED VERSIONS: Applicable .NET Framework 3.5–4.8.1 installations across affected Windows 10/11 and Windows Server releases. IMPACT: An untrusted search-path vulnerability can allow an authenticated attacker to bypass Windows Defender Application Control (WDAC) restrictions. EXPOSURE: Requires local authenticated access. Microsoft describes an attack involving a specially crafted .NET assembly registered for loading by a protected process. Successful exploitation could execute unauthorized code inside that process. This is NOT an unauthenticated remote exploit. EXPLOITATION STATUS: PUBLICLY DISCLOSED VULNERABILITY. Microsoft’s October security updates address the issue. No confirmed exploitation in the wild. Forensic triage: Review unexpected .NET assembly registrations, suspicious assembly loading and anomalous execution within protected processes. Investigate relevant application-control events. No verified malicious IOCs published. URGENT ACTION: Deploy the applicable October 13 .NET Framework security updates. Maintain WDAC enforcement, restrict local privileges and investigate suspicious assembly-loading activity. SOURCE: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108398 OFFICIAL CVE: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108398.json CONFIDENCE: HIGH — Microsoft confirms the bypass and exploitation prerequisites. Trend Micro’s Zero Day Initiative identifies the vulnerability as publicly disclosed but not actively exploited. #CyberSecurity #ThreatIntel #Microsoft #DotNet #WDAC #EndpointSecurity