Two Zero-Days, 1,407 Microsoft Flaws Fixed: October 2026 Patch Tuesday Delivers a Massive Update
Microsoft’s October 2026 Patch Tuesday addresses 1,407 CVEs, including one actively exploited zero-day in Windows Shell (CVE-2026-96951) that bypasses Mark of the Web protections. A second publicly disclosed zero-day affects .NET Framework. Critical remote code execution issues span DHCP, Hyper-V, Exchange, Outlook, and related services. This article covers the key risks, priority fixes, and end-of-support products.
Summary
Microsoft’s October 2026 Patch Tuesday is the largest security release in the company’s history to date. It addresses 1,407 CVEs, including 78 Critical and 1,329 Important issues, across Windows, Office, SharePoint, Exchange, Hyper-V, DHCP, Message Queuing, .NET, and related enterprise components.
One zero-day was actively exploited before patches were available: CVE-2026-96951, a Windows Shell security feature bypass that undermines Mark of the Web protections and is listed in the CISA Known Exploited Vulnerabilities catalog. A second zero-day, CVE-2026-108398 in .NET Framework, had been publicly disclosed. Critical remote code execution is concentrated in DHCP, Hyper-V, Message Queuing, Exchange, Outlook (including reading-pane vectors), Excel, and QUIC. This release is also the final monthly security update for Windows 11 version 24H2 Home and Pro and for Windows 10 Enterprise LTSB 2016.
October 2026 at a Glance
Of the 78 Critical issues, 65 are remote code execution, 11 are elevation of privilege, and 2 are spoofing. Elevation of privilege remains the largest impact class overall at nearly half of the release. That mix matters operationally. Local privilege-escalation paths dominate after an initial foothold, while the Critical RCE set is where network-facing and mail or document attack paths concentrate.
Three themes stand out for defenders. First, infrastructure services that are rarely treated as edge still carry Critical RCE this month, including DHCP, Message Queuing, Hyper-V, and QUIC. Internal segmentation and role inventory matter as much as perimeter patching. Second, Outlook and Office again account for a large share of Critical remote code execution, including multiple reading-pane and preview-pane cases where opening a message is not required. Third, lifecycle pressure lines up with the security rollup. Consumer Windows 11 24H2 editions and Windows 10 Enterprise LTSB 2016 will no longer receive monthly security updates after this release, so deferred upgrades become a permanent exposure decision.
A high count of “Exploitation More Likely” assessments and continued focus on Exchange, SharePoint, and Remote Desktop Gateway further shape priority. Remediation should start with confirmed exploitation (CVE-2026-96951), then Critical RCE on roles present in the environment, then the .NET Framework security feature bypass on systems where application control is in use.
Vulnerability Classification
Breakdown of the 1,407 vulnerabilities addressed:
Critical: 11 · Important: 662
Critical: 65 · Important: 250
Critical: 0 · Important: 252
Critical: 0 · Important: 71
Critical: 0 · Important: 40
Critical: 0 · Important: 29
Critical: 2 · Important: 25
Zero-Day Vulnerabilities
CVE-2026-96951 - Windows Shell Security Feature Bypass
Improper neutralization of special elements in Windows Shell allows an unauthorized attacker to bypass a security feature remotely. Successful exploitation evades Mark of the Web (MotW) defenses, so internet-sourced files may run without the usual Protected View or SmartScreen prompts. User interaction is required, such as opening a crafted file delivered by email, messaging, or download.
Microsoft confirmed exploitation in the wild before the October update. CISA added the issue to the Known Exploited Vulnerabilities catalog with a federal remediation due date of October 16, 2026. This is the third Windows Shell zero-day exploited in the wild in 2026. Affected Windows 10, Windows 11, and Windows Server systems should be updated first.
CVE-2026-108398 - .NET Framework Security Feature Bypass
An untrusted search path in .NET Framework allows an authorized local attacker to bypass a security feature. Successful exploitation can weaken Windows Defender Application Control (WDAC) enforcement and load unauthorized assemblies into protected processes. Local low-privilege access is required. No user interaction is required once that foothold is established.
The issue was publicly disclosed before the official fix. Systems that rely on WDAC or similar application-control policies should be prioritized.
High-Priority Critical Issues
Beyond the zero-days, 65 of 78 Critical issues are remote code execution. The CVEs below cover high-exposure areas from October 2026 coverage, including DHCP, Hyper-V, Exchange, Outlook reading-pane paths, SharePoint, MSMQ, and QUIC. This is not an exhaustive list of all Critical CVEs.
Windows DHCP Server and Client
Multiple Critical remote code execution issues affect Windows DHCP Server (CVE-2026-96934, CVE-2026-88117, CVE-2026-88119, CVE-2026-88120, CVE-2026-88171) and DHCP Client (CVE-2026-70250). DHCP is routinely reachable on internal segments and is a common pivot. DHCP roles should be updated immediately after the exploited zero-day.
Hyper-V and virtualization hosts
Critical Hyper-V remote code execution includes CVE-2026-102214 and CVE-2026-105733. Related Hyper-V elevation of privilege is also fixed this month. Host compromise puts every guest on that hypervisor at risk. Hyper-V hosts should be included in the first infrastructure wave rather than focusing only on guest OS updates.
Message Queuing and QUIC
Critical RCE in Message Queuing (CVE-2026-100202, CVE-2026-108460) and Microsoft QUIC (CVE-2026-105016, CVE-2026-100219) matter wherever MSMQ is enabled or QUIC-facing services are exposed to untrusted networks. Unused MSMQ should be disabled where operationally possible until systems are updated.
Exchange Server
CVE-2026-70571 is a Critical remote code execution vulnerability in Microsoft Exchange Server (CVSS 8.1). Analysis describes high attack complexity and a content-conversion path involving a specially crafted message. Related Exchange issues this month include spoofing and elevation of privilege. Externally reachable Exchange servers should be treated as high priority.
Outlook and Office
Five Critical Outlook remote code execution issues involve reading-pane or preview-pane vectors: CVE-2026-70242 (CVSS 9.8), CVE-2026-70291, CVE-2026-88156, CVE-2026-97016, and CVE-2026-97749. Scrolling past a message or triggering an automatic preview can reach the vulnerable path without opening the item. Office Critical RCE volume is large this month. Excel accounts for the largest share, followed by Outlook, PowerPoint, Word, and Visio. Endpoint Office and Outlook updates should run in parallel with server patching.
SharePoint and Remote Desktop
CVE-2026-102866 is a Critical elevation of privilege in Microsoft Office SharePoint (CVSS 8.1). The issue involves improper cryptographic signature verification. An unauthenticated attacker who obtains a valid proof token for a targeted user can modify the token and authenticate as that user. On-premises SharePoint farms belong in the early infrastructure group.
CVE-2026-70187 is a Critical remote code execution issue in Windows Remote Desktop Gateway Service and should be prioritized on any internet-facing or broadly reachable RDP Gateway deployments.
Affected Products
The October 2026 release spans a broad Microsoft product set. Major technologies addressed include:
- .NET
- .NET Framework
- Active Directory Domain Services
- Active Directory Federation Services (AD FS)
- ASP.NET Core
- Desktop Window Manager
- HID Parser Library
- Microsoft Exchange Server
- Microsoft Graphics Component
- Microsoft Office Access
- Microsoft Office Excel
- Microsoft Office Outlook
- Microsoft Office PowerPoint
- Microsoft Office SharePoint
- Microsoft Office Word
- Microsoft PostScript Printer Driver
- Microsoft QUIC
- Microsoft Windows Media Foundation
- Microsoft Windows Search Component
- Network Policy Server (NPS)
- OpenSSH for Windows
- Remote Desktop Client
- Remote Desktop Gateway Service
- Role: DNS Server
- RPC Runtime
- SQL Server
- Visual Studio Code
- WebDAV
- Windows Ancillary Function Driver for WinSock
- Windows AppX Deployment Service
- Windows Audio Service
- Windows Background Intelligent Transfer Service (BITS)
- Windows Bind Filter Driver
- Windows BitLocker
- Windows Broadcast DVR User Service
- Windows Clipboard User Service
- Windows Common Log File System Driver
- Windows Container Isolation FS Filter Driver (unionfs.sys)
- Windows Device Association Service
- Windows DHCP Server
- Windows Direct Composition
- Windows DNS
- Windows DWM Core Library
- Windows Encrypting File System (EFS)
- Windows Error Reporting
- Windows Event Tracing
- Windows GDI
- Windows Graphics Kernel
- Windows Hello
- Windows Hyper-V
- Windows IKE Extension
- Windows Installer
- Windows iSCSI
- Windows Kernel
- Windows Kernel-Mode Drivers
- Windows Libarchive
- Windows Local Security Authority Subsystem Service (LSASS)
- Windows Management Instrumentation
- Windows Message Queuing Queue Manager
- Windows Modern Device Management (MDM)
- Windows NTFS
- Windows Overlay Filter
- Windows Partition Management Driver
- Windows Print Spooler Components
- Windows Program Compatibility Assistant Service
- Windows Routing and Remote Access Service (RRAS)
- Windows Shell
- Windows SmartScreen
- Windows Spaceport.sys
- Windows Storage
- Windows Storage Spaces Controller
- Windows TCP/IP
- Windows Universal Disk Format File System Driver (UDFS)
- Windows Update
- Windows Update Orchestrator Service
- Windows Update Service
- Windows USB Print Driver
- Windows Virtualization-Based Security (VBS) Enclave
- Windows Win32 Kernel Subsystem
- Windows Win32K
End of Support Products
Several Microsoft products and editions reach the end of updates or end of support on the same date as this Patch Tuesday (October 13, 2026). Devices that remain on these builds will not receive further monthly security updates. Official lifecycle references: Microsoft Lifecycle - End of support 2026 and product-specific lifecycle pages on Microsoft Learn.
- Windows 11 version 24H2 (Home, Pro, Pro Education, Pro for Workstations, and SE). This is the final monthly security update for these editions. Enterprise and Education editions of 24H2 continue to receive updates until October 2027. Microsoft recommends upgrading eligible devices to a supported version such as 25H2 or 26H2. Windows 11 Home and Pro lifecycle
- Windows 10 Enterprise LTSB 2016 / Windows 10 IoT Enterprise LTSB 2016. End of updates with this release under Microsoft’s fixed lifecycle policy. Windows 10 2016 LTSB lifecycle
- Office LTSC 2021 and related 2021 LTSC applications (including Access, Excel, Outlook, PowerPoint, Word, Visio, Project, and Office LTSC 2021 for Mac). End of support on October 13, 2026. No further security updates or technical support. Organizations should plan migration to Microsoft 365 Apps or Office LTSC 2024 where an on-premises long-term channel is required. Office 2021 / Office LTSC 2021 lifecycle
Unsupported systems that stay online after these dates remain exposed to newly discovered flaws with no vendor patch path.
Additional Details
CVE-2026-92707 - MessagePack-CSharp Denial of Service
Improperly controlled sequential memory allocation in MessagePack-CSharp allows an unauthorized attacker to deny service over a network when an application deserializes untrusted MessagePack data as object. A small nested-array payload can trigger large memory allocations before depth limits reject the input.
Applications that use MessagePack or ASP.NET Core SignalR with AddMessagePackProtocol() and hub methods accepting object should confirm MessagePack is at a fixed version (2.5.303 or later, or 3.1.9 or later on the 3.x line) and update dependent packages accordingly.
This CVE has been added to this section because it is a publicly disclosed Moderate issue in the third-party MessagePack-CSharp library, sits outside the Windows security rollup, and requires a separate package update in any .NET application that uses MessagePack or SignalR MessagePack protocol.
Microsoft also published an exploratory risk-cohort grouping for this release. These are provisional groups of CVEs that share a similar environment-assessment question. Microsoft states that cohorts are not an official vulnerability classification, do not change update guidance, and do not replace individual CVE review. They are not used here to reorder the product list. See Using risk cohorts to prioritize security updates.
Mitigation and Security Recommendations
-
Address CVE-2026-96951 first.
The actively exploited Windows Shell MotW bypass should lead the deployment queue on all affected Windows systems. Align with CISA KEV timelines where applicable. -
Prioritize Critical infrastructure RCE next.
DHCP, Hyper-V, Message Queuing, Exchange, SharePoint, Remote Desktop Gateway, and QUIC roles should follow immediately after the zero-day. -
Accelerate Outlook and Office updates on endpoints.
Reading-pane and document-based Critical RCE paths make user workstations a parallel priority, not a secondary wave. -
Apply patch for CVE-2026-108398 where application control is in use.
Environments that depend on WDAC or similar policies should not delay the .NET Framework security feature bypass fix. -
Migrate end-of-support editions.
Windows 11 24H2 Home/Pro (and related consumer SKUs), Windows 10 Enterprise LTSB 2016, and Office LTSC 2021 have no further security updates after this release. -
Update MessagePack-CSharp where applications deserialize untrusted data.
Treat CVE-2026-92707 as a dependency fix for .NET apps using MessagePack or SignalR MessagePack protocol, separate from the OS security rollup. -
Validate with inventory and scanning.
Use centralized patch reporting and vulnerability scanning to confirm installation across the large surface area of this release.
Instantly Fix Risks with Saner Patch Management
Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.
It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.
Experience the fastest and most accurate patching software here.
