Philip Odjidja
Vulnerability Engineer
Philip Odjidja Linked In
Microsoft
Microsoft has addressed 1,411 CVEs in the October 2026 Patch Tuesday release, making it the second consecutive of Microsoft delivering the largest Patch Tuesday update on record. The release includes fixes for three zero-day vulnerabilities, one of which had already been exploited in the wild.
Among this month's updates are 70 Critical vulnerabilities, comprising 57 RCEs, 11 elevation of privilege flaws, and 2 spoofing vulnerabilities.
Zero-day vulnerabilities
CVE-2026-96951 is an Important Windows Shell security feature bypass vulnerability with a CVSS score of 8.8. Microsoft confirmed it was actively exploited as a zero-day. An attacker could use social engineering techniques, such as malicious email attachments or messages, to trick a user into opening a specially crafted file, resulting in the bypass of the Mark of the Web (MOTW) protection mechanism.
This is the third Windows Shell vulnerability exploited in the wild during 2026, following CVE-2026-21510 patched in February and CVE-2026-32202 patched in April.
CVE-2026-108398 is an important .NET Framework security feature bypass vulnerability with a CVSS score of 8.8. The vulnerability was publicly disclosed before a security update was available. An attacker could exploit it by registering a malicious .NET assembly on a vulnerable system and causing it to be loaded by a protected process.
Successful exploitation would allow the attacker to bypass Windows Defender Application Control (WDAC), potentially enabling the execution of unauthorised code
CVE-2026-92707 is a denial-of-service (DoS) vulnerability affecting the MessagePack-CSharp serialisation library. Successful exploitation could allow an attacker to cause excessive resource consumption, resulting in application instability or service disruption. Systems using vulnerable versions of MessagePack-CSharp should be updated to the latest patched release to mitigate the risk.
Critical
CVE-2026-70571 is a critical remote code execution (RCE) vulnerability affecting Microsoft Exchange Server, with a CVSS score of 8.1. Microsoft has assessed the vulnerability as "Exploitation More Likely."
An attacker could exploit this flaw by sending a specially crafted email to a vulnerable Exchange Server. When the server processes the email through its internal content conversion mechanisms, arbitrary code could be executed on the Exchange Server, potentially allowing an attacker to gain control of the affected system.
CVE-2026-70229 is an RCE vulnerability affecting Windows Active Directory Domain Services (AD DS). It received a CVSSv3 score of 8.1 and is rated as critical. Microsoft assesses this vulnerability as “Exploitation More Likely” according to Microsoft’s Exploitability Index.
An attacker could exploit this vulnerability by sending a crafted packet to the vulnerable AD DS service. Successful exploitation could grant an attacker code execution on the vulnerable system.
CVE-2026-105016 is a critical Microsoft QUIC remote code execution vulnerability (CVSS 9.8) that could allow an unauthenticated attacker to execute code remotely by sending a specially crafted network packet. Given its severity and broad impact across Windows and .NET platforms, organisations should prioritise patching affected systems
Important
CVE-2026-70279 is a spoofing vulnerability affecting Microsoft Exchange Server. It received a CVSSv3 score of 9.3 and is rated as important. It was assessed as “Exploitation More Likely.” An attacker could exploit this vulnerability by convincing a target through social engineering to click on a malicious link. Successful exploitation against a target with administrative privileges would allow an attacker to access or modify organizational data. CVE-2026-96940 is another Elevation of Privilege Vulnerability affecting Microsoft Exchange Servers.
CVE-2026-100214 is a Microsoft Dynamics 365 Business Central remote code execution vulnerability (CVSS 8.8) that could allow an authenticated attacker to execute arbitrary code over the network by exploiting insecure deserialization of data. Successful exploitation could allow an attacker to compromise the confidentiality, integrity, and availability of the affected application and underlying system.
CVE-2026-69673, CVE-2026-69718, CVE-2026-69733 and CVE-2026-69783 are all Windows Update Elevation of Privilege Vulnerabilities rated as important and assessed as “Exploitation More Likely. Prompt patching is recommended to minimise the risk of unauthorised privilege escalation on affected devices.
Windows Server 2012 End of Support
The final year of Extended Security Updates (ESU) for Windows Server 2012 and Windows Server 2012 R2 has now ended, and Microsoft will no longer provide security updates for these operating systems. Organisations should identify and upgrade any remaining Windows Server 2012/2012 R2 systems to supported versions to maintain security and compliance.
In addition, extended support for Windows 10 Enterprise 2016 LTSB and Windows 10 IoT Enterprise LTSB 2016 ended on 13 October 2026. Devices still running these versions will no longer receive security updates and should be upgraded to a supported Windows release as soon as possible.
Recent updates from other Vendors
Adobe has released security updates for multiple products, including Adobe Commerce, Substance 3D Sampler, ColdFusion, Photoshop, Dimension, and Framework.
Cisco released security updates for numerous products, including critical vulnerabilities in its NX-OS data center network operating system (CVE-2026-76471) that can let attackers run arbitrary code with root privileges on Nexus switches.
Fortinet released security updates for numerous products, including a critical FortiMail vulnerability (CVE-2026-104286) that attackers exploited in zero-day attacks.
Ivanti released security updates for an actively exploited zero-day vulnerability in the Ivanti Connect Secure (ICS) remote access gateway.
SAP security patch day saw the release of 16 new security notes and 4 GitHub security advisories.
Check Point released security updates addressing multiple vulnerabilities. Customers are advised to apply the latest hotfixes and patches.
Citrix security bulletins published vulnerabilities affecting NetScaler ADC (CVE-2026-88779) and NetScaler Gateway deployments (CVE-2026-107406)
SonicWall released security updates for a critical SMA1000 server-side request forgery (SSRF) flaw, which attackers exploited within two days.