Microsoft is publishing 1,413 own-product vulnerabilities on October 2026 Patch Tuesday, including 1,102 vulnerabilities in Windows. Anyone who enjoyed last month’s record-setting Patch Tuesday will love the October 2026 edition, because it’s much bigger still. As Rapid7 has noted over the course of 2026, there is every reason to suppose that vulnerability volumes will continue to rise. Microsoft is aware of exploitation in the wild for just one of the vulnerabilities published today, as well as public disclosure for two others.
Windows Shell: zero-day security feature bypass
The Windows Shell is Microsoft’s term for the GUI interaction logic for the entire OS provided by explorer.exe and associated libraries and APIs, and for the second time this year, the Windows Shell is the site of an exploited-in-the-wild zero-day vulnerability. Today’s specimen is CVE-2026-96951. Once again, the immediate prize for an attacker is a Mark of the Web (MOTW) bypass. What this means is that Windows won’t provide the user with a dialog explaining that Windows protected their PC, because in this case, it didn’t. Exploitation requires that a user opens a specially crafted malicious file or visits an attacker-controlled site, so the evergreen advice about being careful what you click remains valid. Fans of vintage operating systems should note that Windows Server 2012 doesn’t receive a patch, although Server 2012 R2 does. The advisory acknowledges reporters from multiple organizations, although none from within Microsoft. The vulnerability also affected Microsoft’s Outlook.com cloud services, although Outlook.com was patched in a build dated several weeks ago.
.NET Framework: zero-day security feature bypass
Microsoft is aware of some level of public disclosure of CVE-2026-108398, a .NET Framework security feature bypass. Exploitation requires an attacker with an existing foothold to register a malicious .NET assembly for loading by a protected process, bypassing Windows Defender Application Control (WDAC) enforcement. Microsoft rebranded WDAC as App Control for Business several years ago, so you may know it under its new name. The Microsoft Learn page for Application Control for Windows points out that “your organization's data is one of its most valuable assets... and threat actors want it”, and this is, of course, correct. The patch presumably removes an attacker-controlled location from the list of places .NET Framework searches for registered assemblies, which are typically contained within DLLs and executables. If any further indications were needed that vulnerability volumes are increasing industry-wide, this is only the second month that Microsoft has published vulnerabilities with six-digit CVE numbers, but these extra-large CVEs will seem unremarkable from now on.
Outlook: multiple no-interaction RCEs
The sheer volume of vulnerabilities in recent Patch Tuesday releases can easily include several examples of potentially concerning vulnerabilities, each of which might have been more remarkable in its own right back when volumes were lower. Today, Microsoft has published five separate remote code execution vulnerabilities in Outlook where the preview pane is a vector, meaning that simply scrolling past an email in the Outlook reading pane would be sufficient to trigger exploitation. Worse still, Outlook might helpfully display the preview without any user interaction at all. All five of CVE-2026-70242, CVE-2026-97749, CVE-2026-97016, CVE-2026-88156, and CVE-2026-70291 receive fixes in the same patches. No-interaction Outlook preview pane vulnerabilities can sometimes feature prominently in state-backed actor campaigns, with CVE-2023-23397 as a prominent example in this category.
Edge: security updates unclear
In September 2026, Microsoft did not appear to publish any desktop browser security advisories between the start of the month and Patch Tuesday. In October, a slightly different approach has emerged: several recent entries in the Edge security updates release notes mention new versions of Edge which incorporate the latest updates from the Chromium project, but without detailing which vulnerabilities have been fixed, stating instead, “CVE's will be added as soon as available,” and directing readers to the Security Update Guide (SUG). At the time of writing, the SUG lists a total of zero vulnerabilities addressed in Edge in the first 13 days of October, and the “CVE’s added soon” message has been up for over a week. As a result, defenders have no obvious way of knowing which recent vulnerabilities Microsoft has addressed in Edge.
Microsoft lifecycle update
In Microsoft product lifecycle news, today sees Windows 11 24H2 Home & Pro reach end of servicing, while Windows Server 2022 moves to extended support, with free critical security updates continuing but no further feature development. Also this month, the final curtain falls for Windows Server 2012 and 2012 R2 with the expiry of the third and final year of cash-for-updates Extended Security Update (ESU) program for these aging workhorses. Microsoft lists the end of ESU Year 3 on October 14, 2026, in both cases. Microsoft has a long history of providing at least some security patches for products beyond the end of support, with Server 2008 being a case in point, but the time to move past Server 2012 is now. Office 2021 also moves into retirement on October 14; this includes the Long-Term Servicing Channel, with no ESU available in that case.
Also on October 15, 2026, Exchange Server 2016 and Exchange Server 2019 finally join the “no ESU” club, after two previous six-month reprieves. Microsoft seems to really mean it this time, since any future Exchange Server CVEs released by MSRC will stop mentioning Exchange 2016 and 2019. However, Microsoft points out that a lack of warnings does not mean those unsupported versions are not vulnerable to future security issues.
Summary charts
Apps vulnerabilities
Azure vulnerabilities
Developer Tools vulnerabilities
ESU vulnerabilities
Microsoft Dynamics vulnerabilities
Microsoft Office vulnerabilities
Open Source Software vulnerabilities
Other vulnerabilities
Server Software vulnerabilities
SQL Server vulnerabilities
System Center vulnerabilities
Windows vulnerabilities
Uncategorized Vulnerabilities
Zero-Day Vulnerabilities: Known Exploited
| | Windows Shell Security Feature Bypass Vulnerability | Exploitation Detected | No | 8.8 |
Zero-Day Vulnerabilities: Publicly Disclosed (No known exploitation)
| CVE-2026-108398 | .NET Framework Security Feature Bypass Vulnerability | Exploitation Less Likely | Yes | 8.8 | | CVE-2026-92707 | MessagePack-CSharp Denial of Service Vulnerability | | Yes | 5.3 |
Critical RCEs and EoPs
| CVE-2026-88102 | Microsoft Failover Cluster Remote Code Execution Vulnerability | Exploitation Unlikely | No | 9.8 | | CVE-2026-96864 | Microsoft Failover Cluster Virtual Driver Remote Code Execution Vulnerability | Exploitation Unlikely | No | 9.8 | | CVE-2026-70242 | Microsoft Office Outlook Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-70291 | Microsoft Office Outlook Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-88156 | Microsoft Office Outlook Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-97016 | Microsoft Office Outlook Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-97749 | Microsoft Office Outlook Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-88178 | Microsoft Office PowerPoint Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-70300 | Microsoft Office Word Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-97816 | Microsoft OpenSSH for Windows Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-70147 | Microsoft PostScript Printer Driver Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-70153 | Microsoft PostScript Printer Driver Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-83578 | Microsoft PowerShell Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-100219 | Microsoft QUIC Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-105016 | Microsoft QUIC Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-83517 | Microsoft Windows Media Foundation Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-85814 | Microsoft Windows Media Foundation Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-105010 | Microsoft Windows Search Component Elevation of Privilege Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-83935 | Microsoft XML Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-100222 | Network Policy Server (NPS) Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-85806 | Network Policy Server (NPS) Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-21413 | Raw Image Extension Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-84015 | Remote Access Point-to-Point Protocol (PPP) EAP-TLS Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-83910 | RPC Runtime Library Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-102238 | Visual Studio Code Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.6 | | CVE-2026-83869 | Windows Domain Name Service Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-96113 | Windows Domain Name Service Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-96909 | Windows BitLocker Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-83780 | Windows CCFFilter Driver Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-96320 | Windows DHCP Server Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-96934 | Windows DHCP Server Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-83519 | Windows Error Reporting Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-83693 | Windows Error Reporting Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-83748 | Windows Error Reporting Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-97815 | Windows Error Reporting Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-69886 | Windows Imaging Component Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-70024 | Windows Internet Information Services Remote Code Execution Vulnerability | Exploitation Unlikely | No | 9.8 | | CVE-2026-69634 | Windows iSCSI Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-69705 | Windows iSCSI Remote Code Execution Vulnerability | Exploitation Unlikely | No | 9.8 | | CVE-2026-69883 | Windows iSCSI Remote Code Execution Vulnerability | Exploitation Unlikely | No | 9.8 | | CVE-2026-69639 | Windows libarchive Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-96219 | Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-96096 | Windows Media Player Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-100202 | Windows Message Queuing Queue Manager Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-83862 | Windows Network Load Balancing Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-96924 | Windows OLE Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-97805 | Windows Partition Management Driver Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-70096 | Windows Rich Text Edit Control Remote Code Execution Vulnerability | Exploitation Unlikely | No | 9.8 | | CVE-2026-85792 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-85809 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-83782 | Windows Shell Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-70157 | Windows System Information Console Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-102210 | Windows Text Shaping Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-83770 | Windows Text Shaping Remote Code Execution Vulnerability | Exploitation Unlikely | No | 9.8 | | CVE-2026-97814 | Windows Text Shaping Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | | CVE-2026-85928 | Windows Volume Manager Extension Driver Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 |
Article tags
- Patch Tuesday
- Vulnerability Management
