Microsoft’s October 2026 Patch Tuesday Fixes 1,413 Flaws, Including Three Zero-Days

Oct 14, 2026 · Original article ↗

Summary

Microsoft’s October 2026 update fixes 1,413 flaws, including three zero-days and more than 70 critical vulnerabilities. Priorities include an actively exploited Windows Shell flaw, Outlook RCEs, and updates for network-facing services.

Key points

The October 13 release addresses 1,413 vulnerabilities across Microsoft products, setting a monthly record for the second month in a row.
Three zero-days are included: an actively exploited Windows Shell Mark of the Web bypass, plus publicly disclosed flaws in .NET Framework and MessagePack-CSharp.
Five Outlook remote-code-execution flaws are rated 9.8; two can be triggered through the Preview Pane without user interaction.
Critical fixes also affect services including DHCP Server, Microsoft QUIC, Message Queuing, and Windows Text Shaping.
Several high-scoring cloud-service flaws were fixed server-side and require no customer installation.
The article recommends prioritizing the exploited Windows Shell flaw, patching exposed systems and affected applications, and verifying update coverage.

Article Details

Event Type: Microsoft's October 2026 Patch Tuesday security update addressing 1,413 vulnerabilities, including three zero-days.
Impact: The update fixes more than 70 Critical vulnerabilities across Microsoft products and services. One zero-day, CVE-2026-96951 in Windows Shell, is reported as actively exploited and can bypass Mark of the Web protections. Two other zero-days were publicly disclosed but have no known exploitation: CVE-2026-108398 affects .NET Framework and can bypass Windows Defender Application Control, while CVE-2026-92707 is a denial-of-service flaw in MessagePack-CSharp. The article also highlights critical Outlook remote-code-execution flaws, including two exploitable through the Preview Pane, and says several high-scoring cloud-service flaws were fixed server-side without customer action.

CVE

CVE-2026-108398Two publicly disclosed flaws complete the zero-day count: CVE-2026-108398, a .NET Framework bypass of Windows Defender Application Control, and CVE-2026-92707, a denial of service flaw in the MessagePack-CSharp library.CVE-2026-70291CVE-2026-97749, CVE-2026-88156, CVE-2026-70291, CVE-2026-70242, CVE-2026-97016 (CVSS 9.8): Microsoft Office Outlook Remote Code Execution Vulnerability CVE-2026-88156CVE-2026-97749, CVE-2026-88156, CVE-2026-70291, CVE-2026-70242, CVE-2026-97016 (CVSS 9.8): Microsoft Office Outlook Remote Code Execution Vulnerability CVE-2026-88178CVE-2026-88178 (CVSS 9.8): Microsoft Office PowerPoint Remote Code Execution Vulnerability CVE-2026-92707Two publicly disclosed flaws complete the zero-day count: CVE-2026-108398, a .NET Framework bypass of Windows Defender Application Control, and CVE-2026-92707, a denial of service flaw in the MessagePack-CSharp library.CVE-2026-96951CVE-2026-96951, an actively exploited Mark of the Web bypass in Windows Shell, should be the first patch deployed across Windows fleets.

People

James ForshawMicrosoft credits him with discovering CVE-2026-108398.

Vendors

MicrosoftMicrosoft’s October 2026 Patch Tuesday, released on October 13, 2026, fixes 1,413 vulnerabilities across Windows, Office, Exchange Server, SharePoint, .NET, Azure services, and developer tools.

Products