Today is Microsoft Patch Tuesday for October 2026. There are 1416 vulnerabilities that have been addressed this time around. One of them is an actively exploited zero-day and one has been publicly disclosed. We recommend applying these updates as soon as possible.

Notable Patch Tuesday Vulnerabilities for October

CVE-2026-96951

A command injection flaw in Windows Shell allows an attacker to bypass the Mark of the Web protection. The attacker needs to trick a user into opening a specially crafted file, for example one sent by email or instant message. This is a zero-day that is actively exploited.

CVE-2026-108398

An untrusted search path in .NET Framework lets an attacker who already has an account on the system bypass Windows Defender Application Control and run code in a protected process. The vulnerability has been publicly disclosed but is not known to be exploited.

CVE-2026-70571

A stack-based buffer overflow in Microsoft Exchange Server allows an unauthenticated attacker to execute code on the server by sending a specially crafted email, without any user interaction. Microsoft considers exploitation more likely, so on-premises Exchange servers should be patched early.

CVE-2026-70229

An authorization flaw in Active Directory Domain Services allows an unauthenticated attacker to execute code by sending a specially crafted packet over the network. Exploitation depends on specific network configurations and timing, but Microsoft still considers it more likely, so domain controllers should be prioritized.

For more detailed information on these and other vulnerabilities, please refer to the release notes: https://msrc.microsoft.com/update-guide/releaseNote/2026-Oct

Need help addressing the above in your own organization? Speak to an Outpost24 expert.