Microsoft’s October 2026 Patch Tuesday addresses 1407 CVEs (CVE-2026-96951)

CVE-2026-100214 is an insecure-deserialization flaw (CWE-502) in Microsoft Dynamics Business Central. An attacker who already has a low-privileged authorized account can send crafted data over the network and trigger deserialization of untrusted input, with no user interaction required. Successful exploitation gives remote code execution with high impact to confidentiality, integrity, and availability (CVSS 3.1 base score 8.8, scope unchanged). Organizations that run Dynamics Business Central are affected, but the CVE data does not list specific version ranges. It is not in the CISA KEV catalog and no public proof-of-concept is known.

Do: Apply the Microsoft security update that fixes CVE-2026-100214 for your Dynamics Business Central servicing channel as soon as it is offered; the CVE record does not name a fixed build, so match the update to this CVE ID rather than guessing a version. Until it is installed, restrict network access to Business Central, keep accounts at least privilege, and watch for unexpected code execution from authenticated sessions.

CVE-2026-102217 is an improper resolution of path equivalence (CWE-41) in Microsoft WebDAV. An attacker who already has low-privileged, authorized access can exploit it over the network without user interaction, because the component treats equivalent paths as distinct and then grants higher privileges. Successful exploitation yields high impact to confidentiality, integrity, and availability (CVSS 3.1 base score 8.8). The affected version range is not stated in the available data. It is not listed in CISA KEV and no public proof-of-concept is known.

Do: Apply the Microsoft security update that covers CVE-2026-102217 as soon as it is available for your builds, and confirm WebDAV roles or the WebClient service are only enabled where required. Until patched, limit network access to WebDAV to trusted accounts and segments and review WebDAV logs for unexpected path or privilege changes. No public workaround or fixed version number is given in the source data.

CVE-2026-108398 is an untrusted search path flaw (CWE-426) in Microsoft .NET Framework. A locally authorized attacker can exploit it without user interaction to bypass a security feature, with changed scope and high impact to confidentiality, integrity, and availability (CVSS 3.1 base score 8.8). The issue is local only (AV:L, PR:L) and does not by itself grant remote access. It affects systems running the vulnerable .NET Framework builds; exact version ranges were not included in the source data. It is not listed in CISA KEV, and no public proof-of-concept is known; related October 2026 Patch Tuesday reporting describes other Microsoft flaws under attack, not this one.

Do: Install Microsoft's October 2026 security updates that cover .NET Framework on all supported Windows systems as soon as they are available for your release. Until patched, limit local logon rights to trusted accounts and avoid running untrusted binaries from writable directories that could sit earlier in the process search path. No public workaround specific to this CVE is documented in the source data.

Microsoft Windows Shell contains a protection mechanism failure (CWE-693) that allows an unauthorized attacker to bypass a security feature, which CISA notes can be reached over a network. Successful exploitation defeats a Windows defense-in-depth control, weakening protections an attacker would otherwise have to evade as part of a broader intrusion; the available data does not describe a code-execution or privilege-escalation gain. Any system running Microsoft Windows falls within CISA's published affected scope, and specific version ranges have not been enumerated in the available data. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-02-10, confirming exploitation in the wild, and its EPSS score of 26.2% (98th percentile) signals elevated near-term exploitation risk; ransomware use is unknown and no public proof-of-concept is known.

Do: Apply Microsoft's applicable Windows security update through Windows Update/WSUS or your patch-management process as soon as practical, prioritizing internet-exposed and high-value systems; because the issue is in CISA's KEV catalog (added 2026-02-10), U.S. federal agencies must apply the vendor fix, applicable BOD 22-01 mitigations (including for cloud services), or discontinue use by the catalog due date. Until patched, follow Microsoft's mitigation guidance from vendor advisories and monitor for updates, since specific affected builds and the exploited security feature have not been detailed in the available data.

A protection mechanism in the Windows Shell fails (CWE-693), allowing an unauthorized attacker to perform spoofing against the shell over a network. Per the CVSS vector, the attack is network-based, requires no privileges or special conditions, but does require the targeted user to interact with attacker-supplied content. The impact is limited to confidentiality: an attacker can misrepresent information presented through the Windows Shell, gaining a spoofing foothold rather than code execution, privilege escalation, or persistence. Any organization running the affected Windows 10, Windows 11, or Windows Server builds is exposed, which effectively means most Windows estates. Microsoft has confirmed active exploitation, CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-04-28, and a fix shipped in Microsoft's April 2026 Patch Tuesday release.

Do: Apply Microsoft's April 2026 security updates to all affected Windows 10, Windows 11, and Windows Server hosts as a priority; the flaw is on CISA's KEV catalog, so U.S. federal agencies must patch within BOD 22-01 timelines or apply vendor-recommended mitigations. Until patched, note that exploitation requires user interaction with spoofed shell content, so user awareness about verifying shell-rendered information is a partial mitigations. No public PoC is known, but confirmed in-the-wild exploitation warrants prioritizing user-facing and internet-reachable systems for patching.

CVE-2026-69673 is an improper link resolution before file access (CWE-59, link following) flaw in Microsoft Windows Update. A locally authorized attacker with low privileges can trigger it without user interaction to follow a link during file access and elevate privileges. Successful exploitation yields high impact to confidentiality, integrity, and availability on the local system (CVSS 3.1 base score 7.8). It affects Windows systems that use the vulnerable Windows Update component; exact build ranges are not stated in the source data, and Microsoft’s October 2026 Patch Tuesday is reported to address it among a large set of fixes. There is no known public proof of concept and it is not listed in CISA’s Known Exploited Vulnerabilities catalog.

Do: Install Microsoft’s October 2026 Patch Tuesday security updates that cover Windows Update as soon as they are available for your Windows builds. Until systems are patched, limit local logon to trusted accounts and watch for unexpected privilege changes; no public exploit or CISA KEV listing is known from this data.

CVE-2026-69880 is a type-confusion flaw (CWE-843) in Microsoft Desktop Window Manager. An attacker who already has a local, authorized logon can trigger incompatible-type access and elevate privileges to high impact on confidentiality, integrity, and availability. The issue is local only (AV:L, PR:L, UI:N) and is rated CVSS 3.1 7.8 (high). It affects Windows systems that include Desktop Window Manager; exact builds are not listed in the source data, and Microsoft assigned the CVE as part of the October 2026 Patch Tuesday. It is not in CISA KEV, and no public proof-of-concept is known.

Do: Install Microsoft's October 2026 security updates that address CVE-2026-69880 on all supported Windows systems that include Desktop Window Manager. Until patches are applied, limit local accounts to least privilege and treat untrusted local code as a privilege-escalation risk. No public workaround or specific fixed build is named in the provided data.

CVE-2026-69918 is a heap-based buffer overflow (CWE-122) in Microsoft Windows Core Messaging. An attacker who is already authorized to log on locally can trigger it without further user interaction and with low attack complexity. Successful exploitation elevates privileges with high impact on confidentiality, integrity, and availability, and the changed scope means the effect can extend beyond the vulnerable component. It affects Windows systems that include the Core Messaging component; the provided data does not name specific versions or builds. It is not on the CISA Known Exploited Vulnerabilities list, and no public proof-of-concept is known.

Do: Install the Microsoft security update that covers CVE-2026-69918 as soon as it is available for your Windows builds, and confirm the fix in your patch-management console. Until then, limit who can log on locally, avoid leaving untrusted accounts signed in, and watch for unexpected privilege changes from low-privilege processes. No public workaround or fixed version number is given in the source data.

CVE-2026-69923 is an uncontrolled search path element (CWE-427) in Microsoft Windows AI. An attacker who is already authorized as a local user can abuse how the component locates files or binaries to elevate privileges, without user interaction. Successful exploitation yields high impact on confidentiality, integrity, and availability on the local system (CVSS 3.1 base score 7.8, vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected version ranges are not stated in the provided data. It is not listed in CISA KEV, and no public proof-of-concept is known.

Do: Install the current Microsoft security updates for Windows as soon as a fix for CVE-2026-69923 is published, and confirm the Windows AI component is included. Until then, limit local accounts to least privilege and treat untrusted local users as a privilege-escalation risk. No public workaround or fixed version is given in the provided data.

CVE-2026-69926 is a type-confusion flaw (CWE-843) in Microsoft Desktop Window Manager, in which the component accesses a resource using an incompatible type. An attacker who already has an authorized local account can trigger it without further user interaction and elevate privileges on the same machine. Successful exploitation yields high impact to confidentiality, integrity, and availability (CVSS 3.1 base score 7.8; local, low complexity, low privileges). It affects Windows systems that include Desktop Window Manager and was addressed among Microsoft’s October 2026 Patch Tuesday updates; specific version ranges are not listed in the source data. It is not in CISA’s Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.

Do: Install Microsoft’s October 2026 security updates that include the fix for CVE-2026-69926 on all supported Windows systems that run Desktop Window Manager. Until patched, treat this as a local elevation-of-privilege issue: limit who can log on interactively, and watch for unusual privilege changes after a low-privileged session. No public workaround is described in the advisory data.

CVE-2026-70054 is a heap-based buffer overflow (CWE-122) in the Windows NetBIOS component. An attacker who is already authorized to run code locally can trigger the overflow without further user interaction and elevate privileges on the same machine. Successful exploitation yields high impact to confidentiality, integrity, and availability (CVSS 3.1 base score 7.8: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). It affects Microsoft Windows systems that include the vulnerable NetBIOS code; the provided data does not name specific builds. It is not in CISA’s Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.

Do: Install Microsoft’s security update for CVE-2026-70054 on every supported Windows system as soon as it is offered for your builds. Until then, limit local logon to trusted accounts and watch for unexpected privilege changes. No public exploit is known and the issue is not in CISA’s KEV catalog.

CVE-2026-70229 is an incorrect-authorization flaw (CWE-863) in Microsoft Active Directory Domain Services. A remote, unauthenticated attacker can exploit it over the network without user interaction, though Microsoft rates attack complexity as high (CVSS 3.1 base score 8.1). Successful exploitation can lead to code execution with high impact on confidentiality, integrity, and availability of the affected domain controller, with unchanged scope. It affects organizations that run Active Directory Domain Services; exact product builds are not stated in the source data and are covered by the October 2026 Microsoft updates. It is not listed in CISA KEV, and no public proof-of-concept is known.

Do: Install Microsoft's October 2026 security updates on every domain controller that runs Active Directory Domain Services, then confirm the update applied. Until patching is complete, keep domain controllers off the internet, restrict which networks can reach AD protocols, and watch for unexpected remote code execution or privilege changes.

CVE-2026-70279 is a cross-site scripting flaw (CWE-79) in Microsoft Exchange Server caused by improper neutralization of input during web page generation. An unauthenticated attacker on the network can supply malicious input that is rendered in a page a victim loads, so exploitation requires user interaction. Successful use can spoof content or actions in a changed security scope, with high impact on confidentiality and integrity and no direct availability impact (CVSS 3.1 base score 9.3). On-premises Exchange Server deployments are affected; the advisory data does not name specific version ranges. It is not listed in CISA KEV, and no public proof-of-concept is known.

Do: Apply Microsoft's security update for CVE-2026-70279 to on-premises Exchange Server as soon as it is available for your build, and confirm the fix in the Microsoft Security Update Guide. Until then, limit internet exposure of Outlook on the web and the Exchange admin center, and treat unexpected Exchange web content or links as untrusted because exploitation needs a user to load attacker-controlled content.

CVE-2026-88159 is a use-after-free flaw in the Windows Background Intelligent Transfer Service (BITS), a component that ships with Windows. Microsoft states that an attacker can trigger it over the network; the CVSS 3.1 vector (8.8) indicates low attack complexity, low privileges required, and no user interaction, with high impact to confidentiality, integrity, and availability in the same security scope. Successful exploitation allows remote code execution. Windows systems that include the unpatched BITS component are affected, but the supplied data does not list specific version or build ranges. It is not in the CISA Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known; it was addressed in Microsoft's October 2026 Patch Tuesday.

Do: Install Microsoft's October 2026 security updates that cover CVE-2026-88159 on all supported Windows clients and servers as soon as they are offered for your builds. Until those updates are applied, reduce remote access for low-privileged accounts and watch for unexpected BITS service crashes or unusual transfer jobs. No public exploit or CISA KEV listing is known, but the 8.8 score still warrants prompt patching.

CVE-2026-96940 is a weak-authorization flaw in Microsoft Exchange Server (CWE-1390) that lets an already authenticated attacker elevate privileges over the network. It is remotely reachable with low attack complexity and no user interaction, and the CVSS 3.1 vector rates confidentiality, integrity, and availability impact as high while keeping scope unchanged. A low-privileged authenticated user can therefore gain high-impact control of the affected Exchange component. Affected version ranges were not included in the provided data, so any on-premises Exchange Server deployment should be checked against Microsoft's advisory. It is not listed in CISA KEV, and no public proof-of-concept is known.

Do: Check Microsoft's advisory for CVE-2026-96940 and install the Exchange Server security update for every build it lists as affected. Until that update is applied, limit network access to Exchange to trusted users and networks, and review privileged role assignments and authentication logs for unexpected elevation.

CVE-2026-96951 is a command-injection flaw (CWE-77) in the Windows Shell in which special elements in a command are not properly neutralized. An unauthorized attacker can trigger it remotely with no prior privileges if a user interacts with attacker-controlled content, and Microsoft describes the result as bypassing a security feature; the CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) rates confidentiality, integrity, and availability impacts as high. Affected products named in the data are Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), Windows Server 2012 and 2016, and Outlook on the web. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-10-13, so exploitation in the wild is confirmed; ransomware use is listed as unknown and no public proof-of-concept is known.

Do: Apply Microsoft's security updates for every listed Windows and Outlook on the web build as soon as they are available, and follow CISA BOD 26-04 (including cloud guidance or discontinuation if a mitigation is unavailable). Prioritize internet-facing and high-value assets, and because exploitation needs user interaction, reinforce phishing-resistant handling of untrusted content while you patch.