Microsoft’s October 2026 Patch Tuesday Fixes 1,413 CVEs, Including Two Zero-Days
Summary
Microsoft's October 2026 updates address 1,413 CVEs, including two zero-days—one actively exploited. Researchers highlight critical Outlook, SharePoint, SQL Server, and QUIC flaws and urge prioritizing patches by exploitability.
Key points
- Microsoft disclosed 1,413 CVEs in its October update, including 80 critical flaws; 1,102 affect Windows.
- Zero-day CVE-2026-96951 in Windows Shell is under active exploitation and can bypass Mark of the Web protections and dependent security checks.
- CVE-2026-108398 affects .NET Framework; exploitation requires local access and a low-privilege account, and Microsoft considers exploitation less likely.
- Other highlighted flaws include a critical Outlook Reading Pane RCE (CVE-2026-70242), SharePoint privilege escalation (CVE-2026-102866), SQL Server RCE (CVE-2026-65674), and Microsoft QUIC RCE (CVE-2026-105016).
- Experts recommend prioritizing patches based on exploitability and exposure, including rapid updates for Exchange and Windows endpoints and servers.
Article Details
- Vulnerability Types
- Security bypass
- Untrusted search path
- Remote code execution
- Heap-based buffer overflow
- Elevation of privilege
- Improper cryptographic signature verification
- Deserialization of untrusted data
- Severity
- Reported flaws include critical vulnerabilities and vulnerabilities with CVSS scores of 8.1, 8.8, and 9.8.
- Affected Versions
- Exchange 2016
- Exchange 2019
- Exchange Subscription Edition
- Windows 11 23H2
- Windows 11 24H2
- Windows 11 25H2
- Windows 11 26H2
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
CVE
CVE-2026-102866Dustin Childs, head of threat awareness for the Zero Day Initiative (ZDI) at TrendAI, warned security teams about CVE-2026-102866 (CVSS 8.1), a Microsoft Office SharePoint elevation of privilege vulnerability.CVE-2026-105016ripe for prioritization is a heap-based buffer overflow RCE flaw in Microsoft QUIC, tracked as CVE-2026-105016 (CVSS score 9.8). It could allow an unauthenticated attacker to execute malicious code on affectedCVE-2026-108398Both of the zero-days are potentially scary security bypasses. CVE-2026-96951 (CVSS 8.8) is the one under active exploit, found in Windows Shell. The other is CVE-2026-108398, found in .NET Framework Security.CVE-2026-21413Microsoft also republished a Cisco Talos bug, CVE-2026-21413, which is listed as a raw image extension remote code execution (RCE) vulnerability.CVE-2026-65674He also noted CVE-2026-65674 (CVSS 8.8), which is a Microsoft SQL Server RCE bug, as having "the best exploitability rating of any SQL Server bug this month. It’s a deserialization of untrusted data. An authenticatedCVE-2026-70242One vulnerability that Automox researchers also flagged is a critical Reading Pane RCE in Outlook, tracked as CVE-2026-70242 (CVSS 9.8).CVE-2026-96940CVE-2026-96951Both of the zero-days are potentially scary security bypasses. CVE-2026-96951 (CVSS 8.8) is the one under active exploit, found in Windows Shell. The other is CVE-2026-108398, found in .NET Framework Security.
People
Dustin ChildsHead of threat awareness for the Zero Day Initiative at TrendAI; discussed Microsoft vulnerabilities in the October patch release.Jack BicerDirector of vulnerability research at Action1; discussed CVE-2026-105016.Mike WaltersPresident and co-founder of Action1; discussed CVE-2026-108398.Tyler RegulyAssociate director for security R&D at Fortra; commented on Microsoft vulnerability statistics.
Vendors
Products
.NET FrameworkBoth of the zero-days are potentially scary security bypasses. CVE-2026-96951 (CVSS 8.8) is the one under active exploit, found in Windows Shell. The other is CVE-2026-108398, found in .NET Framework Security.Microsoft Exchange Serverfor Office, 61 in Developer Tools (Dev Div), 36 for SharePoint Server, 22 for SQL Server, seven for Exchange Server, 15 in Azure, and four in Defender. Thirty-two are found in various "other" categories.Microsoft QUICAnother concerning bug that's ripe for prioritization is a heap-based buffer overflow RCE flaw in Microsoft QUIC, tracked as CVE-2026-105016 (CVSS score 9.8). It could allow an unauthenticated attacker to executeMicrosoft WindowsIn terms of what's lurking inside this month's bumper crop of bugs, Windows harvested the lion's share of the security flaws listed — accounting for 1,102 of them, to be exact. That's followed by 134 for Office, 61 inOfficeof the security flaws listed — accounting for 1,102 of them, to be exact. That's followed by 134 for Office, 61 in Developer Tools (Dev Div), 36 for SharePoint Server, 22 for SQL Server, seven for Exchange Server,OutlookOne vulnerability that Automox researchers also flagged is a critical Reading Pane RCE in Outlook, tracked as CVE-2026-70242 (CVSS 9.8).SharePoint Serverof them, to be exact. That's followed by 134 for Office, 61 in Developer Tools (Dev Div), 36 for SharePoint Server, 22 for SQL Server, seven for Exchange Server, 15 in Azure, and four in Defender. Thirty-two areSmart App Controlchecks that rely on it, including SmartScreen, Office Protected View, the Office block on macros, Smart App Control on Windows 11, and the Attachment Manager prompt.SmartScreenusers in such a way that bypasses MoTW — and the downstream security checks that rely on it, including SmartScreen, Office Protected View, the Office block on macros, Smart App Control on Windows 11, and the AttachmentSQL ServerThat's followed by 134 for Office, 61 in Developer Tools (Dev Div), 36 for SharePoint Server, 22 for SQL Server, seven for Exchange Server, 15 in Azure, and four in Defender. Thirty-two are found in various "other"Visual Studioa network, and affects multiple Microsoft products, including Windows 11, Windows Server, .NET, and Visual Studio.Windows 11on it, including SmartScreen, Office Protected View, the Office block on macros, Smart App Control on Windows 11, and the Attachment Manager prompt.Windows Defender Application Controlit to load in a protected process, then runs code inside that process without tripping Windows Defender Application Control (WDAC)."Windows Serveron affected systems over a network, and affects multiple Microsoft products, including Windows 11, Windows Server, .NET, and Visual Studio.Windows ShellBoth of the zero-days are potentially scary security bypasses. CVE-2026-96951 (CVSS 8.8) is the one under active exploit, found in Windows Shell. The other is CVE-2026-108398, found in .NET Framework Security.