1.0 Introduction
Recently, Microsoft released security updates to address multiple vulnerabilities in its products.
2.0 Impact
These
vulnerabilities could allow attackers to achieve elevation of privilege, remote
code execution, information disclosure, denial-of-service, security restriction
bypass, data manipulation or spoofing. Proof-of-concept exploit code is
publicly available for two further .NET flaws: CVE-2026-108398, a security
feature bypass in .NET Framework, and CVE-2026-92707, a denial-of-service in
.NET.
3.0 Affected Products
- Microsoft Windows
- Windows Extended Security Updates (ESU)
- Developer Tools (including .NET and .NET Framework)
- Microsoft Azure
- Microsoft Office
- Microsoft Dynamics
- Microsoft System Center
- Microsoft SQL Server
- Microsoft Apps
- Server Software
- Open Source Software
4.0 Recommendation
CyberSecurity Malaysia encourages users and
administrators to review the following Microsoft Security Update Guide and
apply the necessary updates. Priority should be given to systems exposed to the
exploited Windows Shell vulnerability (CVE-2026-96951).
Kindly refer to the following URL:
- https://msrc.microsoft.com/update-guide/
- https://msrc.microsoft.com/update-guide/releaseNote/2026-Oct
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951
Generally, we advise users to be
updated with the latest security announcements by the vendor and follow best
practice security policies to determine which updates should be applied.
For further enquiries, please contact Cyber999
Incident Response Centre through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
Business Hours: Mon - Fri 08:30 -17:30 MYT
Web: https://www.cybersecurity.my
5.0 References
- https://msrc.microsoft.com/update-guide/
- https://msrc.microsoft.com/update-guide/releaseNote/2026-Oct
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951