Microsoft’s October 2026 security update fixes a record 1,411 flaws, including one in Windows that
attackers are already using to slip malicious files past built-in safety warnings. Two more flaws were
publicly revealed before a fix existed, and critical bugs in Active Directory, Exchange, and SharePoint
could let attackers take over servers. Organisations should install the October updates on all Windows
systems now, starting with user machines and then domain controllers, Exchange, and SharePoint
servers.
1. Vulnerability Details
Microsoft released fixes for 1,411 flaws on 13 October 2026, with 70 rated Critical (57 remote code execution, 11
elevation of privilege, 2 spoofing). Counts vary by tracker: Tenable reports 1,407 CVEs and 69 Critical. The figure
excludes 348 flaws Microsoft fixed earlier in October. One zero-day is exploited in the wild and two were publicly
disclosed before the patch.
- CVE-2026-96951 (CVSS 8.8): Windows Shell, actively exploited Command injection in Windows Shell that bypasses Mark of the Web, Protected View, and blocking when a user opens a crafted file received by email, chat, or download. Microsoft has not shared exploitation details. It is the third Windows Shell flaw exploited in 2026, after CVE 2026-21510 (linked to APT28) and CVE-2026-32202.
- CVE-2026-96951 (CVSS 8.8): Windows Shell, actively exploited Command injection in Windows Shell that bypasses Mark of the Web, Protected View, and blocking when a user opens a crafted file received by email, chat, or download. Microsoft has not shared exploitation details. It is the third Windows Shell flaw exploited in 2026, after CVE 2026-21510 (linked to APT28) and CVE-2026-32202.
- CVE-2026-108398 (CVSS 8.8): .NET Framework, publicly disclosed Untrusted search path flaw that lets an authenticated attacker register a crafted .NET assembly for loading by a protected process, bypassing Windows Defender Application Control (WDAC) enforcement. Reported by James Forshaw of Google Project Zero. No exploitation reported.
- CVE-2026-92707 (Moderate): MessagePack-CSharp, publicly disclosed Denial of service caused by improperly controlled sequential memory allocation in .NET, exploitable over a network. No exploitation reported.
2. Affected Products
- Windows 10, Windows 11, and Windows Server (Windows Shell)
- .NET Framework and MessagePack-CSharp
- Active Directory Domain Services and Active Directory Federation Services
- Microsoft Exchange Server
- Microsoft SharePoint
3. End of Support
- Final update for older builds October 2026 is the last security update for Windows 11 version 24H2 Home and Pro and for Windows 10 Enterprise LTSB 2016. Windows 11 23H2 Enterprise, Education, and IoT Enterprise stop receiving security updates from next month.
4. Other Notable CVEs
- CVE-2026-70229 (CVSS 8.1): Active Directory Domain Services remote code execution via a crafted packet; Critical, Exploitation More Likely.
- CVE-2026-70571 (CVSS 8.1): Exchange Server remote code execution when the server processes a malicious email; Critical, Exploitation More Likely.
- CVE-2026-70279 (CVSS 9.3): Exchange Server spoofing via a malicious link; against an administrator can expose or change organisational data; Exploitation More Likely.
- CVE-2026-102866 (CVSS Critical): SharePoint signature verification flaw letting an unauthenticated attacker with a valid proof token hijack a targeted user account.
- CVE-2026-96222, CVE-2026-108131 (CVSS Critical) Active Directory Federation Services (AD FS) spoofing vulnerabilities.
5. Recommendations
- Install the October 2026 cumulative updates on all Windows 10, Windows 11, and Windows Server systems, starting with user endpoints because of the exploited CVE-2026-96951.
- Patch domain controllers (CVE-2026-70229), Exchange (CVE-2026-70571, CVE-2026-70279), SharePoint (CVE-2026-102866), and AD FS servers first among servers.
- Apply the .NET Framework updates for CVE-2026-108398 on systems that rely on Windows Defender Application Control (WDAC) to block unapproved applications.
- Until patched, quarantine executable and shortcut attachments at the email gateway, and alert on Explorer launching cmd or powershell right after a user opens a downloaded file.
- Move Windows 11 24H2 Home and Pro and Windows 10 LTSB 2016 machines to supported versions, since October is their last security update.
6. Sources
- https://www.bleepingcomputer.com/news/microsoft/microsoft-october-2026-patch-tuesday-fixes1-411-flaws-3-zero-days
- https://www.tenable.com/blog/microsofts-october-2026-patch-tuesday-addresses-1407-cves-cve
2026-96951 - https://www.helpnetsecurity.com/2026/10/14/microsoft-patch-tuesday-cve-2026-96951-motw-bypa
ss/
Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn
No related posts found.