Microsoft's October 2026 Updates Fix 1,400+ Flaws at Two Trust Boundaries

TL;DR

• A Patch Tuesday release is the single monthly batch in which Microsoft publishes security fixes for Windows, Office, Exchange Server and its server products, and the October 2026 batch shipped on 13 October with more than 1,400 separate vulnerabilities addressed.
• CrowdStrike counts 1,413 vulnerabilities in the release, SANS ISC counts 1,417; neither page explains the four-flaw gap, so a report should name the counter it quotes.
• One flaw is confirmed exploited in the wild: CVE-2026-96951, a Windows Shell security feature bypass rated Important at CVSS 8.8, which strips the Mark of the Web tag that SmartScreen and Office Protected View read before a downloaded file runs. CISA added it to the KEV catalogue on 13 October with a remediation deadline of 16 October 2026.
• Two critical AD FS spoofing flaws, CVE-2026-108131 at CVSS 7.5 and CVE-2026-96222 at CVSS 7.4, let an unauthenticated network attacker spoof the federation service, and every relying party that trusts that service inherits the exposure.
• Twenty critical remote code execution flaws sit in Excel, PowerPoint, Visio and Word, six of them triggered through the Preview Pane, plus five Outlook RCEs at CVSS 9.8 with two of those reachable from the Reading Pane.
• A second bypass, CVE-2026-108398 in .NET Framework at CVSS 8.8, defeats Windows Defender Application Control for an attacker who already holds local credentials, which is the flaw that matters most on estates that rely on application allow-listing.
• A workable triage order starts with the exploited Windows Shell flaw, already past its CISA deadline, alongside internet-facing federation, then moves to the services that answer before authentication.

What Microsoft released on 13 October 2026

Microsoft published its October 2026 security update on 13 October, covering Windows, Office, Exchange Server, Microsoft QUIC, the PostScript printer driver, DHCP Server and Message Queuing. CrowdStrike's analysis of the release counts 1,413 vulnerabilities, including one exploited zero-day, two publicly disclosed zero-day flaws and 75 rated Critical. SANS ISC's diary for the same release, written by Johannes Ullrich, counts 1,417 vulnerabilities, 76 rated critical, and notes seven critical flaws that require no customer action.

Two analyses of one Microsoft release, four flaws apart. Neither page explains the difference. Our reading is that ordinary counting choices, such as revised advisories or product groupings, can move a total by a few entries. Neither total is wrong. A team that quotes one of them without naming the counter has produced a number nobody can reconcile later.

The release hits two trust boundaries. The first is file-origin trust: the Mark of the Web tag and the application allow-list both decide whether code from outside may run, and CVE-2026-96951 and CVE-2026-108398 each defeat one of them. The second is identity trust: AD DS on the domain controllers, and AD FS for every application that relies on federation.

The composition of the release is more useful than its total. Elevation of privilege accounts for 677 patches, or 48%, remote code execution for 317, or 22%, and information disclosure for 254, or 18%. Fifteen vulnerabilities allow unauthenticated remote code execution over the network, spread across DHCP Server, QUIC, the PostScript printer driver and PDF handling.

The exploited flaw removes the tag that warns users

CVE-2026-96951 is the one flaw in this release that Microsoft confirms has been exploited. It is a Windows Shell security feature bypass, rated Important with a CVSS score of 8.8, and its effect is to evade Mark of the Web, the trust mechanism that makes Protected View open downloaded Office documents in a sandbox and makes SmartScreen warn before a downloaded executable runs. The attack needs social engineering: SANS notes that the victim still has to open the file. Once the zone tag is gone, the downstream controls that read that tag stop applying.

CISA's catalogue turns that into a deadline with a date on it. The agency added CVE-2026-96951 to the Known Exploited Vulnerabilities catalogue on 13 October with a remediation due date of 16 October 2026, inside a catalogue that now lists 1,748 entries. The catalogue names the flaw "Microsoft Windows Command Injection Vulnerability", which is CISA's own labelling; Microsoft classifies it as a security feature bypass. Anyone reconciling the two lists by title will spend ten minutes learning that the CVE identifier is the only reliable key.

A second bypass in the same release matters for locked-down estates, and it gets a section of its own below.

Take a concrete case. An office of forty people receives the monthly batch through one update ring that runs on the second Thursday. The exploit deadline lands before the ring moves, so the cumulative update that carries the Windows Shell fix has to go out of band, or the ring has to move early. Skipping the choice leaves the one flaw in the release that someone is already using.

A second bypass targets application allow-listing

CVE-2026-108398 in .NET Framework is rated Important at CVSS 8.8, had details public before the release, and, in the SANS diary's words, can be used to "bypass application control and execute unauthorized applications"; CrowdStrike lists it as a bypass of Windows Defender Application Control that needs an authenticated attacker with local access, who places a crafted .NET assembly on the system. SANS notes that Microsoft had not detected exploitation at the time of publication. For an organisation that treats application allow-listing as its main control on administrative workstations, a bypass of that control outranks several 9.8s that need network reach it does not have.

AD FS spoofing reaches every application that trusts the federation

Active Directory Federation Services brokers authentication across organisational boundaries, which is why the two spoofing flaws in this release carry more weight than their CVSS scores suggest. CVE-2026-108131 scores 7.5 and CVE-2026-96222 scores 7.4, both allow an unauthenticated network attacker to perform spoofing, and Microsoft rates both Critical. The second involves improper certificate validation, and CrowdStrike notes that its exploitation requires high attack complexity because of environmental and configuration dependencies.

A CVSS score of 7.5 sits below most Office RCEs in the same batch, and it describes a different kind of consequence. Token forgery or an authentication bypass at the federation service propagates to every relying party application that trusts it, so the number of applications behind the federation is the real measure of blast radius, and that number is usually larger than the team that owns AD FS expects.

Exposure is specific. Organisations still running on-premises AD FS for hybrid identity or partner federation carry it; organisations that have moved authentication to a cloud identity provider do not, for this pair of flaws. The question worth answering before the next release is which applications still trust a local federation service and who owns that service when it needs an emergency change.

The identity tier has a third entry. CVE-2026-70229 in Active Directory Domain Services is a Critical remote code execution flaw at CVSS 8.1. CrowdStrike says an unauthenticated attacker can send a specially crafted packet to a domain controller over the network and run code with no user interaction, with high attack complexity because exploitation depends on specific network configurations and timing conditions. The service cannot be disabled without removing the domain controller role, so the update is what closes it.

Office and the preview pane carry twenty critical RCEs

Twenty critical remote code execution flaws sit across Excel, PowerPoint, Visio and Word, with CVSS scores from 7.5 to 9.8. Six list the Preview Pane as an attack vector, all six in PowerPoint or Word: CVE-2026-88178 at 9.8, CVE-2026-70215 and CVE-2026-88144 at 8.8, CVE-2026-70269 and CVE-2026-88185 at 8.1, and CVE-2026-88207 at 7.5. A file can trigger them while a user views it in the Preview Pane, without opening it. Microsoft states that CVE-2026-88178 could be exploited by submitting a crafted presentation to an affected Office Online service, with no authentication and no user interaction.

Outlook adds five critical RCE flaws at CVSS 9.8, and two of them, CVE-2026-70291 and CVE-2026-88156, are reachable from the Reading Pane. An attacker sends a crafted message; the recipient sees it render. Outlook runs with the logged-in user's credentials and cached tokens, so a successful trigger hands over whatever that user can reach. Across Office applications, CrowdStrike counts 23 Preview Pane-triggered CVEs in this release.

The compensating control most teams already own is a mail gateway that neutralises attachments and rewrites or blocks active content before it reaches the client. Turning off the Reading Pane would remove part of the exposure and costs a measurable amount of daily work, which is why it tends to stay on.

A triage order for a 1,400-item release

Order the work by what is already exploited, then by blast radius, then by what answers before authentication.

• The exploited flaw first: CVE-2026-96951, by applying the cumulative update out of band or moving the ring early, since its CISA deadline of 16 October has passed.
• Identity alongside it. AD DS CVE-2026-70229 on domain controllers, then AD FS CVE-2026-108131 and CVE-2026-96222, because every relying party inherits a token problem.
• Network services that answer before authentication: QUIC listeners with CVE-2026-100219 and CVE-2026-105016 at 9.8, DHCP Server with CVE-2026-96934 at 9.8 and ten RCEs in total per SANS, the PostScript printer driver with CVE-2026-70147 and CVE-2026-70153 at 9.8, and Message Queuing with CVE-2026-100202 at 9.8.
• Exchange Server, where CVE-2026-70571 is triggered by a specific email during content conversion and Microsoft rates the attack complexity high.
• Estates that run Defender Application Control: CVE-2026-108398.
• Office and Outlook in the normal ring, with attachment handling checked at the gateway.
• Everything else in the monthly batch, on the schedule the estate already runs.

An inventory of which services answer before authentication is the same inventory that tells you what to monitor. Netics builds infrastructure monitoring with plain-language alerts around assets a team has declared, which is why the declaration comes first.

The 16 October 2026 KEV deadline has passed. The fixes are in the October batch either way, and the batch is the deliverable. What remains is the only question the release cannot answer for you: which of those 1,413 entries sits on a service that strangers can reach.

Sources

Source: October 2026 Patch Tuesday: 1,413 CVEs Include Three Zero-Days and 75 Critical Vulnerabilities — crowdstrike.com blog (https://www.crowdstrike.com/en-us/blog/patch-tuesday-analysis-october-2026/), 13 October 2026, retrieved 2026-10-17 (1,413 vulnerabilities including one exploited zero-day, two publicly disclosed zero-day vulnerabilities and 75 Critical; risk composition of 677 elevation-of-privilege patches, 317 remote code execution and 254 information disclosure; 23 Preview Pane-triggered CVEs across Office applications; 15 unauthenticated network-reachable RCEs spanning DHCP Server, QUIC, PostScript Printer Driver and PDF handling; AD DS CVE-2026-70229 as a Critical unauthenticated RCE against domain controllers at CVSS 8.1 with high attack complexity; AD FS CVE-2026-108131 at CVSS 7.5 and CVE-2026-96222 at CVSS 7.4 as Critical spoofing flaws with high attack complexity on the second; CVE-2026-96951 as an Important Windows Shell security feature bypass at CVSS 8.8 exploited in the wild and evading Mark of the Web; CVE-2026-108398 as a publicly disclosed .NET Framework bypass of Windows Defender Application Control at CVSS 8.8; twenty Critical Office RCEs with six Preview Pane vectors and the CVE-2026-88178 Office Online note; five Outlook RCEs at CVSS 9.8 with CVE-2026-70291 and CVE-2026-88156 reachable from the Reading Pane; QUIC, PostScript Printer Driver, DHCP Server and Message Queuing flaws each rated 9.8).

Source: October 2026 Microsoft Patch Tuesday — isc.sans.edu diary (https://isc.sans.edu/diary/October+2026+Microsoft+Patch+Tuesday/33422/), published 2026-10-13 by Johannes Ullrich, retrieved 2026-10-17 (1,417 vulnerabilities patched, 76 rated critical, seven critical vulnerabilities requiring no customer actions, one vulnerability disclosed before the release and one already exploited; CVE-2026-96951 as a Windows Shell security feature bypass that allows bypassing the Mark of the Web and still requires the victim to open the file; CVE-2026-108398 as a .NET framework bypass of application control with no exploitation detected; ten DHCP Server remote code execution vulnerabilities including five critical; CVE-2026-70571 in Exchange Server with high attack complexity; the note that the volume of Office vulnerabilities is noteworthy; per-CVE CVSS base scores in the diary table, including CVE-2026-70215 and CVE-2026-88144 at 8.8, CVE-2026-70269 and CVE-2026-88185 at 8.1 and CVE-2026-88207 at 7.5).

Source: Known Exploited Vulnerabilities Catalog — cisa.gov (https://www.cisa.gov/known-exploited-vulnerabilities-catalog, JSON feed https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json), catalogVersion 2026.10.16, dateReleased 2026-10-16, retrieved 2026-10-17 (a catalogue of 1,748 entries; CVE-2026-96951 listed as Microsoft Windows Command Injection Vulnerability, added 2026-10-13 with a remediation due date of 2026-10-16).

Source: CVE-2026-96951 — Microsoft Security Update Guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951), retrieved 2026-10-17 (the affected product rows and KB numbers shown in the capture above).

Source: October 2026 release notes — Microsoft Security Update Guide (https://msrc.microsoft.com/update-guide/releaseNote/2026-Oct), dated 17 October 2026 on the page, retrieved 2026-10-17 (the KB numbers per product shown in the capture above).

Source: the five pages listed above, retrieved 2026-10-17. Images are captures of CISA's and Microsoft's own pages, plus two Netics editorial diagrams.