Microsoft’s October 2026 Patch Tuesday Fixes 1,413 Vulnerabilities, Including an Exploited Zero-Day

Oct 13, 2026 · Original article ↗

Summary

Microsoft’s October 2026 updates address 1,413 vulnerabilities, including one exploited zero-day, two publicly disclosed flaws and 75 Critical vulnerabilities. The analysis highlights high-impact issues across Windows, Office, Outlook and other products.

Key points

Microsoft reports one actively exploited zero-day: CVE-2026-96951, a Windows Shell flaw that bypasses Mark of the Web protections when a user opens or clicks malicious content.
Two other vulnerabilities were publicly disclosed: a .NET Framework WDAC bypass and a MessagePack-CSharp denial-of-service flaw.
The release includes 75 Critical vulnerabilities; elevation of privilege, remote code execution and information disclosure are the leading vulnerability types.
Several highlighted flaws can enable code execution through little or no user interaction, including Office Preview Pane issues and critical Outlook vulnerabilities.
Critical unauthenticated network-reachable RCE flaws affect components including Microsoft QUIC, DHCP Server, the PostScript Printer Driver, MSMQ, Exchange Server and Active Directory Domain Services.
The update also includes Hyper-V guest-to-host escape vulnerabilities and critical Active Directory Federation Services spoofing flaws.
Microsoft says six vulnerabilities in its cloud services were mitigated server-side and require no customer action.

Article Details

Event Type: Microsoft's October 2026 Patch Tuesday security update release.
Impact: Microsoft addressed 1,413 vulnerabilities, including one zero-day confirmed exploited in the wild, two publicly disclosed zero-days, and 75 Critical vulnerabilities. Reported high-impact issues include unauthenticated remote code execution in multiple Windows and Microsoft services, Office and Outlook vulnerabilities that can be triggered through document or email previews, and flaws affecting identity and virtualization components.

CVE

People

Jonathan Bar OrThe article credits him with discovering CVE-2026-97793.

Vendors

MicrosoftMicrosoft addressed 1,413 vulnerabilities in its October 2026 security update release, including one exploited zero-day vulnerability, two publicly disclosed zero-day vulnerabilities, and 75 Critical vulnerabilities.

Products

.NET FrameworkPublicly Disclosed Vulnerability in .NET Framework Active Directory Federation ServicesIdentity platform components carry critical vulnerabilities this month, with RCE and spoofing flaws affecting both Active Directory Domain Services (AD DS) and Active Directory Federation Services (AD FS).Microsoft Exchange ServerCritical Remote Code Execution Vulnerability in Microsoft Exchange Server Microsoft OfficeWindows received the most patches this month with 1,123, followed by ESU with 977 and Microsoft Office with 179.Microsoft OutlookMicrosoft Outlook alone accounts for five critical RCE vulnerabilities this month, including CVE-2026-70242 and CVE-2026-70291, reinforcing email as a persistent high-value attack vector.Microsoft PostScript Printer DriverCritical Remote Code Execution Vulnerabilities in Microsoft PostScript Printer Driver Microsoft QUICCVE-2026-100219 and CVE-2026-105016 in Microsoft QUIC represent exposure on any service using QUIC transport, which is increasingly common in modern web infrastructure.Microsoft SharePointCritical Elevation of Privilege Vulnerability in Microsoft SharePoint Microsoft WindowsWindows received the most patches this month with 1,123, followed by ESU with 977 and Microsoft Office with 179.Windows Active Directory Domain ServicesCritical Remote Code Execution Vulnerability in Windows Active Directory Domain Services Windows DHCP ServerCritical Vulnerability in Windows DHCP Server Windows Hyper-VCritical Vulnerabilities in Windows Hyper-V Windows KernelCritical Elevation of Privilege Vulnerability in Windows Kernel Windows Message Queuing Queue ManagerCritical Vulnerability in Windows Message Queuing Queue Manager Windows Raw Image ExtensionCritical Vulnerability in Windows Raw Image Extension Windows Remote Desktop Gateway ServiceCVE-2026-70187 is a Critical RCE vulnerability in the Windows Remote Desktop Gateway Service and has a CVSS score of 8.1.Windows ShellExploited Zero-Day in Windows Shell Windows Text ShapingCritical Vulnerability in Windows Text Shaping