Patch Tuesday October 2026: One Zero-Day, 76 Critical Fixes Among 1,417 CVEs

Microsoft's October 2026 release fixes 1,417 vulnerabilities, 76 of them rated Critical. Of those, one is already exploited in the wild and one was public before the fix shipped.

Start October’s patching with Windows Shell: attackers are already exploiting a flaw that bypasses Mark of the Web defenses, and it is in CISA’s Known Exploited Vulnerabilities catalog.

On-premises Exchange also needs early attention, with flaws that can turn a crafted email into server-side code execution or a clicked link into actions under an administrator’s privileges.

Separately, the publicly disclosed .NET Framework bypass can defeat Windows Defender Application Control enforcement and allow unauthorized applications to run; Microsoft rates exploitation less likely, but affected systems still need the update.

CVE-2026-96951 is a command-injection flaw in Windows Shell that lets an unauthorized attacker bypass Mark of the Web defenses over a network. The attack scenario involves sending a targeted Windows user a specially crafted file through email or instant messaging; the attacker cannot force the user to view attacker-controlled content.

The consequence is a bypass of a security defense, with exploitation already observed—not merely a theoretical route around it. Prioritize the applicable Windows update for affected systems.

On-premises Exchange is the next priority. CVE-2026-70571 allows an unauthenticated attacker to send a crafted email that triggers an internal content-conversion process and can execute code on the server without user interaction. Exploitation requires deep knowledge of the target environment and is not guaranteed to succeed, but Microsoft rates it more likely.

The spoofing flaw CVE-2026-70279 takes a different route: an attacker needs no authentication, but must persuade a user to click a crafted link. An administrator’s click could let the attacker act with that user’s privileges, potentially accessing or modifying organizational data.

Install the applicable Exchange updates, including the fix for the weak-authentication elevation-of-privilege flaw CVE-2026-96940. Microsoft has already deployed the related Exchange Online service-side fix; Exchange Online customers need take no action to receive it.

Beyond Exchange, CVE-2026-100214 gives an authenticated attacker with low-level access to a Dynamics Business Central server a path to code execution through a crafted request, without user interaction.

Windows Core Messaging’s CVE-2026-69918 is a local elevation-of-privilege flaw that can give an authorized attacker SYSTEM privileges. Both need customer patching. Active Directory Domain Services also needs attention for CVE-2026-70229, an unauthenticated network code-execution flaw: Microsoft rates exploitation more likely, but success depends on particular network configurations and timing conditions, so it is not reliable across all environments.

Not counted above: 343 open-source CVEs (mostly Azure Linux packages) that Microsoft republished this month. Azure Linux admins should pick those up through the normal package updates.

Patch CVE-2026-96951 in Windows Shell first: active exploitation and the ability to evade Mark of the Web make it the immediate priority. Follow with affected on-premises Exchange servers, where the crafted-email code-execution path requires no user interaction, even though exploitation is complex.

Source: Microsoft Security Update Guide and the CISA KEV catalog.