Aggiornamenti Mensili Microsoft (AL03/261014/CSIRT-ITA)
Data:
14 Ottobre 2026
Impatto Sistemico
Critico (77.94)
Sintesi
Microsoft ha rilasciato gli aggiornamenti di sicurezza mensili che risolvono un totale di 1416 nuove vulnerabilità, di cui una di tipo 0-day.
Tipologia
- Remote Code Execution
- Elevation of Privilege
- Information Disclosure
- Denial of Service
- Security Feature Bypass
- Spoofing
- Tampering
Descrizione e potenziali impatti
Nel dettaglio le vulnerabilità sfruttate attivamente o per le quali risulta disponibile in rete un “proof of concept”, riguardano:
- .NET Framework: identificata tramite la CVE-2026-108398, di tipo “ Security Feature Bypass ” e con score CVSS v3.1 pari a 8.8, è dovuta all’utilizzo di un percorso di ricerca non attendibile per il caricamento di assembly. Un attaccante autenticato può collocare un assembly .NET appositamente predisposto su un sistema vulnerabile e registrarlo affinché venga caricato da un processo protetto. Lo sfruttamento di tale vulnerabilità potrebbe consentire di aggirare i meccanismi di sicurezza di Windows Defender Application Control (WDAC), permettendo l’esecuzione di applicazioni non autorizzate e di codice all’interno del processo protetto.
- Windows Shell: identificata tramite la CVE-2026-96951, di tipo “ Security Feature Bypass ” e con score CVSS v3.1 pari a 8.8, è causata da un’errata neutralizzazione di elementi speciali utilizzati nei comandi. Un attaccante non autenticato potrebbe sfruttare tale vulnerabilità tramite file opportunamente predisposti e veicolati attraverso la rete, ad esempio mediante messaggi di posta elettronica o di instant messaging. Lo sfruttamento di tale vulnerabilità potrebbe consentire di aggirare le protezioni Mark of the Web (MOTW). L’attacco richiede tuttavia un’azione da parte dell’utente, che deve aprire un collegamento o interagire con un file predisposto dall’attaccante.
Prodotti e/o versioni affette
- .NET Framework
- ASP.NET Core
- Active Directory Certificate Services (AD CS)
- Active Directory Domain Services
- Active Directory Federation Services (AD FS)
- Azure API Center
- Azure Active Directory
- Azure App Service
- Azure Arc
- Azure CycleCloud
- Azure DevOps
- Azure Event Grid
- Azure HDInsight
- Azure Key Vault
- Azure SRE Agent
- Azure Storage Library
- Connected Devices Platform Service (Cdpsvc)
- Desktop Window Manager
- Dynamics Business Central
- Function Discovery Service (fdwsd.dll)
- Graphic Fonts
- HID Parser Library
- HID class driver
- Internet Explorer
- Linux Kernel
- Microsoft Account
- Microsoft Azure Attestation service and Device Health Attestation Service
- Microsoft Bluetooth Driver
- Microsoft Bookings
- Microsoft COM for Windows
- Microsoft Configuration Manager
- Microsoft Dataverse
- Microsoft Defender
- Microsoft Defender for Endpoint
- Microsoft Digest Authentication
- Microsoft Exchange Server
- Microsoft Failover Cluster Virtual Driver
- Microsoft Graphics Component
- Microsoft Input Method Editor (IME)
- Microsoft Internet Messaging API
- Microsoft Local Security Authority Server (lsasrv)
- Microsoft MPEG-2 Video Extension
- Microsoft Office
- Microsoft Office Access
- Microsoft Office Click-To-Run
- Microsoft Office Excel
- Microsoft Office OneNote
- Microsoft Office Outlook
- Microsoft Office PowerPoint
- Microsoft Office SharePoint
- Microsoft Office Visio
- Microsoft Office Word
- Microsoft Partner Center
- Microsoft PostScript Printer Driver
- Microsoft Power Apps
- Microsoft PowerShell
- Microsoft PowerToys
- Microsoft QUIC
- Microsoft Scripting Engine
- Microsoft Streaming Service
- Microsoft Trace Data Helper
- Microsoft Windows Codecs Library
- Microsoft Windows Media Foundation
- Microsoft Windows PDF
- Microsoft Windows Search Component
- Microsoft XML
- Network Device Enrollment Service (NDES)
- Network Policy Server (NPS)
- OpenSSH for Windows
- Python
- Quality Windows Audio/Video Experience (QWAVE) service
- RPC Endpoint Mapper Service
- RPC Runtime
- Reliable Multicast Transport Driver (RMCAST)
- Remote Access Point-to-Point Protocol (PPP) EAP-TLS
- Remote Desktop Client
- Remote Desktop Display Driver
- Remote Desktop Gateway Service
- Role: DNS Server
- SQL Server
- SQLite
- Servicing Stack Updates
- Skype for Business and Microsoft Lync
- Software Protection Platform (SPP)
- SysInternals
- Virtual Hard Disk (VHD) Miniport Driver
- Visual Studio
- Visual Studio Code
- Visual Studio Tools for Applications and SQL Server Management Studio
- WebDAV
- Windows AI
- Windows ALPC
- Windows Advanced Rasterization Platform
- Windows Aggregated Data Platform Service
- Windows Ancillary Function Driver for WinSock
- Windows AppX Deployment Extensions
- Windows AppX Deployment Service
- Windows Application Compatibility Cache
- Windows Assigned Access
- Windows Audio Service
- Windows Autopilot
- Windows Background Intelligent Transfer Service (BITS)
- Windows Backup Engine
- Windows Bind Filter Driver
- Windows Biometric Service
- Windows BitLocker
- Windows Bluetooth A2DP driver
- Windows Bluetooth Port Driver
- Windows Bluetooth Service
- Windows Broadcast DVR User Service
- Windows CCFFilter Driver
- Windows CD-ROM Driver
- Windows COM+ Event System Service
- Windows Camera Frame Server Monitor
- Windows Cash Drawer Protocol Provider
- Windows Certificates
- Windows Client License Service
- Windows Client Side Caching driver (csc.sys)
- Windows Client for NFS
- Windows Client-Side Caching (CSC) Service
- Windows Clipboard Server
- Windows Clipboard User Service
- Windows Cloud Files Mini Filter Driver
- Windows Common Log File System Driver
- Windows Composite Image File System
- Windows Connected Devices Platform Service
- Windows Connected User Experiences and Telemetry
- Windows Console Driver
- Windows Container Isolation FS Filter Driver
- Windows Container Isolation FS Filter Driver (unionfs.sys)
- Windows Core Messaging
- Windows Credential Guard
- Windows Credential Manager
- Windows Credential Providers
- Windows Cryptographic Services
- Windows DCOM Server
- Windows DHCP Client
- Windows DHCP Server
- Windows DNS
- Windows DWM Core Library
- Windows Defender Firewall Service
- Windows Deployment Services
- Windows Device Association Service
- Windows Device Install Service
- Windows Diagnostic Policy Service
- Windows Direct Composition
- Windows Distributed File System (DFS)
- Windows EAPHost Service
- Windows Embedded Mode Service
- Windows Encrypting File System (EFS)
- Windows Enterprise App Management
- Windows Error Reporting
- Windows Event Logging Service
- Windows Event Tracing
- Windows Event Viewer
- Windows Failover Cluster
- Windows Fast FAT Driver
- Windows Fax and Scan Service
- Windows GDI
- Windows GDI+
- Windows Geotag Broker
- Windows Graphics Kernel
- Windows Group Policy
- Windows HTTP.sys
- Windows Health and Optimized Experiences Service
- Windows Hello
- Windows Host Guardian Service
- Windows Hyper-V
- Windows IKE Extension
- Windows IP Over USB Service
- Windows Image Acquisition
- Windows Imaging Component
- Windows Input System
- Windows Installer
- Windows Internal System User Profile
- Windows Internet (wininet.dll)
- Windows Internet Connection Sharing (ICS)
- Windows Internet Information Services
- Windows Internet Key Exchange (IKE) Protocol
- Windows Kerberos
- Windows Kernel
- Windows Kernel Mode Driver
- Windows Kernel-Mode Drivers
- Windows Key Distribution Center
- Windows Key Storage Provider
- Windows Libarchive
- Windows Local Security Authority (LSA)
- Windows Local Security Authority Subsystem Service (LSASS)
- Windows MIDI Service Module
- Windows Management Instrumentation
- Windows Management Services
- Windows Media
- Windows Media Player
- Windows Media Video Decoder
- Windows Message Queuing
- Windows Message Queuing Queue Manager
- Windows Mobile Broadband
- Windows Mobile Device Management
- Windows Modern Device Management (MDM)
- Windows NDIS
- Windows NTFS
- Windows NTLM
- Windows NetBIOS
- Windows Netlogon
- Windows Network File System
- Windows Network List Service
- Windows Network Load Balancing
- Windows Notification
- Windows Now Playing Session Manager
- Windows OLE
- Windows OLE DB
- Windows Overlay Filter
- Windows PCI Bus Driver
- Windows Paint
- Windows Partition Management Driver
- Windows Perception Simulation Service
- Windows Performance Monitor
- Windows Phone Service
- Windows Portable Device Enumerator Service
- Windows Portable Device File System Driver
- Windows Portable Device MTP Driver
- Windows PowerShell
- Windows Print Spooler Components
- Windows Program Compatibility Assistant Service
- Windows Projected File System
- Windows Push Notifications
- Windows Quality of Service (QoS) Packet Scheduler
- Windows RNDIS
- Windows Raw Image Extension
- Windows Registry
- Windows Remote Access Connection Manager
- Windows Remote Access Service Infrastructure
- Windows Remote Desktop
- Windows Remote Desktop Protocol
- Windows Remote Desktop Services
- Windows Remote POS Driver
- Windows Resilient File System (ReFS)
- Windows Resilient File System (ReFS) Deduplication Service
- Windows Resource Management (MRM)
- Windows Resume
- Windows Rich Text Edit Control
- Windows Routing and Remote Access Service (RRAS)
- Windows SMB Client
- Windows SMB Server
- Windows Schannel
- Windows Secure Boot
- Windows Secure Kernel Mode
- Windows Secure Socket Tunneling Protocol (SSTP)
- Windows Security Account Manager
- Windows Security App
- Windows Security Center
- Windows Security Support Provider Interface
- Windows Sensor Data Service
- Windows Server Update Service
- Windows Server for NFS
- Windows Setup Files Cleanup
- Windows Setup and Deployment
- Windows Shell
- Windows Smart Card
- Windows SmartScreen
- Windows Spaceport.sys
- Windows StateRepository API
- Windows Storage
- Windows Storage Port Driver
- Windows Storage Spaces Controller
- Windows Storage VSP Driver
- Windows Storport Miniport Driver
- Windows Subsystem for Linux
- Windows Sysmain Service
- Windows System Information Console
- Windows TCP/IP
- Windows Telephony Server
- Windows Text Services Framework
- Windows Text Shaping
- Windows UEFI
- Windows UI Immersive Server
- Windows USB Driver
- Windows USB Print Driver
- Windows USB Video Driver
- Windows Universal Disk Format File System Driver (UDFS)
- Windows Universal Plug and Play (UPnP) Device Host
- Windows Update
- Windows Update Delivery Optimization
- Windows Update Orchestrator Service
- Windows Update Service
- Windows Update Stack
- Windows User Profile Service
- Windows VHD miniport driver
- Windows VMSwitch
- Windows Virtual Input
- Windows Virtualization-Based Security (VBS) Enclave
- Windows Volume Manager Extension Driver
- Windows WLAN Service
- Windows WalletService
- Windows Web Account Manager
- Windows Wi-Fi Driver
- Windows Win32 Kernel Subsystem
- Windows Win32K
- Windows Win32K – GRFX
- Windows Win32K – ICOMP
- Windows Wired AutoConfig Service
- Windows Work Folders
- Windows Workstation Service
- Windows exFAT File System
- Windows iSCSI
- Windows kernel32.dll
- Winlogon
Azioni di mitigazione
In linea con le dichiarazioni del vendor, si raccomanda di procedere all’aggiornamento dei prodotti impattati attraverso l’apposita funzione di Windows Update.
Di seguito sono riportate le sole CVE relative alle vulnerabilità con gravità “critica” e “alta”:
Riferimenti
- https://msrc.microsoft.com/update-guide
- https://msrc.microsoft.com/update-guide/releaseNote/2026-oct
CVE
Change log
| Versione | Note | Data |
|---|---|---|
| 1.0 | Pubblicato il 14-10-2026 | 14/10/2026 |
Il presente articolo è un prodotto originale di csirt.gov.it, riproposto qui a solo scopo di aumentarne la visibilità. Può essere visualizzato in versione originale al seguente link
Ultimo aggiornamento
14 Ottobre 2026, 10:49
CSIRT Toscana