Skip to content
Threat Feed
Subscribe
critical advisory

Microsoft October 2026 Security Updates

Microsoft addressed 1,413 vulnerabilities including 75 critical flaws and an exploited zero-day (CVE-2026-96951) bypass in Windows Shell that circumvents Mark of the Web protections.

CVE search metadata

CVE search record: CVE-2026-108398. KEV: no. Product: Windows, Office, Excel, PowerPoint, Visio, DHCP Server, Microsoft QUIC, PostScript Printer Driver, Active Directory Federation Services, Outlook, Windows Shell. Brief: Microsoft October 2026 Security Updates. Brief link: https://feed.craftedsignal.io/briefs/2026-10-october-patch-tuesday/

CVE search record: CVE-2026-70229. KEV: no. Product: Windows, Office, Excel, PowerPoint, Visio, DHCP Server, Microsoft QUIC, PostScript Printer Driver, Active Directory Federation Services, Outlook, Windows Shell. Brief: Microsoft October 2026 Security Updates. Brief link: https://feed.craftedsignal.io/briefs/2026-10-october-patch-tuesday/

CVE search record: CVE-2026-96951. Severity: high. CVSS: 8.8. EPSS: 1.51%. KEV: no. Product: Windows, Office, Excel, PowerPoint, Visio, DHCP Server, Microsoft QUIC, PostScript Printer Driver, Active Directory Federation Services, Outlook, Windows Shell. Brief: Microsoft October 2026 Security Updates. Brief link: https://feed.craftedsignal.io/briefs/2026-10-october-patch-tuesday/

Triage facts

Revision 1
Applicability
Windows, Office +9
Evidence
Unknown
Severity
Critical
Action
Immediate escalation
Sources
1 public source
Freshness
Revision 1Oct 21, 07:58 UTC
Vulnerabilities
3 CVEs
Source quality
A1Very likely

The October 2026 Microsoft security release contains 1,413 CVEs, featuring one exploited zero-day (CVE-2026-96951) and two publicly disclosed zero-days. Notable risks include remote code execution (RCE) in identity services (AD DS, AD FS), critical RCE vulnerabilities in Microsoft Outlook, and 23 preview-pane triggered flaws in Office applications that allow code execution with minimal user interaction.

Impact

The disclosed vulnerabilities include 75 critical-rated items. CVE-2026-96951 allows attackers to strip Mark of the Web (MOTW) protections, facilitating the execution of malicious payloads by bypassing SmartScreen and Office Protected View. Unauthenticated RCEs in DHCP, Microsoft QUIC, and printer drivers enable potential lateral movement. Identity fabric compromise via AD DS and AD FS could allow for complete domain takeover or authentication boundary bypass.

Recommendation

  • Prioritize patching of CVE-2026-96951 (Windows Shell), CVE-2026-70229 (AD DS), and the five critical Outlook RCE vulnerabilities.
  • Audit internal DHCP and QUIC-enabled services for exposure to unauthenticated network access.
  • Evaluate the exposure of AD FS and AD DS interfaces and implement restricted access to mitigate lateral movement risk.
  • For .NET environments, review existing WDAC policies and ensure assembly loading protections are maintained to mitigate CVE-2026-108398.

Immediate actions

Deploy October 2026 security updates across all Windows and Office environments.

IT Operations 24h

Mitigations

Prioritize patching Windows Shell (CVE-2026-96951) and critical Identity service components (AD DS/AD FS).

immediate IT Operations

CVE-2026-96951, CVE-2026-70229