Overview
Microsoft Windows
Microsoft has released a security advisory that addresses a new actively exploited, high severity vulnerability impacting a variety of Windows 11, Windows 10 and Windows Server systems. This successful exploitation of this vulnerability evades Mark of the Web (MOTW) defences, which are designed to restrict certain actions until a user explicitly approves them after being provided with a warning message.
- CVE-2026-96951 – Command Injection Vulnerability – CVSSv3.1 Score: 8.8
To ensure that the vulnerability is patched on your system, download the latest Security Updates for Windows 11, Windows 10, or Windows Server released on the 13th of October 2026.
Visual Studio Code
Microsoft has released security guidance addressing a critical vulnerability within Visual Studio Code. On successful exploitation of this vulnerability, an unauthorised attacker could execute code over a network.
- CVE-2026-102238 – Remote Code Execution Vulnerability – CVSSv3.1 Score 9.6
Affected Versions:
Visual Studio Code version 1.140 and below.
Docker
Docker has released a security advisory regarding a critical vulnerability within Docker Hub’s identity and access management platform. This vulnerability stemmed from incorrect Privilege Assignment within Docker Hub, that allowed a personal access token controlled by one user to be assigned to another user without rotating or revoking the secret. As the personal access token remained unchanged, then the previous user authenticated to the registry as the recipient, enabling them to push, pull or delete images within the recipient’s scope.
- CVE-2026-105445 – Account Conversion Reassign PAT to another User Vulnerability – CVSSv4.0 Score 9.4
Docker patched this internally, individuals and organisations impacted by the vulnerability were contacted. Therefore if you did not receive an email, your account was not exposed and there is no further action required.
Patch Tuesday
Following the latest Patch Tuesday (13th of October), Microsoft released fixes for a record-breaking 1,411 flaws, including 70 critical vulnerabilities, one actively exploited and two publicly disclosed zero-day vulnerabilities. This is also the last update that Windows 11 version 24H2 Home and Pro will receive, as Microsoft advise users to migrate to a supported version of windows, such as the most recently deployed version 26H2.
Recommended Action
Organisations are encouraged to review the appropriate security advisory pages and apply the updates:
Microsoft Windows: Microsoft Windows Security Advisory
Visual Studio Code: VS Code Security Guidance
Docker: Docker Hub Security Advisory