Serial Number:AV26-1038
Date: October 13, 2026
As of October 13, 2026, Microsoft is affected by vulnerabilities in the following products:
- .NET 10.0
- .NET 11.0
- .NET 8.0
- .NET 9.0
- ASP.NET Core 10.0
- ASP.NET Core 11.0
- ASP.NET Core 8.0
- ASP.NET Core 9.0
- Arc Enabled Servers
- Azure API Center
- Azure App Service for Linux
- Azure CLI
- Azure CycleCloud
- Azure Container Storage enabled by Azure Arc
- Azure Event Grid System
- Azure SRE Agent
- Azure Storage Blobs client library for Java
- HVEC Video Extensions
- Microsoft .NET Framework 3.5 AND 4.8.1
- Microsoft .NET Framework 4.8.1
- Microsoft 365 Apps for Enterprise
- Microsoft Bookings
- Microsoft Configuration Manager 2503
- Microsoft Configuration Manager 2509
- Microsoft Configuration Manager 2603
- Microsoft Defender for Endpoint
- Microsoft Dataverse
- Microsoft Dynamics 365 (on-premises) version 9.1
- Microsoft Dynamics NAV 2017
- Microsoft Dynamics NAV 2018
- Microsoft Exchange Server 2016
- Microsoft Exchange Server 2019
- Microsoft Exchange Server Subscription Edition RTM
- Microsoft Office 365
- Microsoft Office LTSC 2021
- Microsoft Office LTSC 2024
- Microsoft Office Online Server
- Microsoft Outlook
- Microsoft Paint
- Microsoft Partner Center
- Microsoft Power Apps
- Microsoft PowerToys
- Microsoft SQL Server 2017
- Microsoft SQL Server 2019
- Microsoft SQL Server 2022
- Microsoft SQL Server 2025
- Microsoft SharePoint Enterprise Server 2016
- Microsoft SharePoint Server 2019
- Microsoft SharePoint Server Subscription Edition
- Microsoft Visual Studio 2022
- Microsoft Visual Studio 2026
- PowerShell 7.4
- PowerShell 7.5
- PowerShell 7.6
- Raw Image Extension on Windows 10
- Raw Image Extension on Windows 11
- Skype for Business Server 2015
- Skype for Business Server 2019
- Skype for Business Server Subscription Edition CU1
- Skype for Business Server Subscription Edition RTM
- Sysinternals Suite
- Visual Studio Code
- Windows 10
- Windows 11
- Windows Defender
- Windows Security App
- Windows Server 2012
- Windows Server 2012 R2
- Windows Server 2016
- Windows Server 2019
- Windows Server 2022
- Windows Server 2025
Microsoft has indicated that CVE-2026-96951 has been exploited.
On October 13, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-96951 to their Known Exploited Vulnerabilities (KEV) Database.
The Cyber Centre encourages users and administrators to review the web link provided, perform the suggested mitigations, and apply the necessary updates.