Microsoft Patch Tuesday, October 2026 Security Update Review

A use-after-free flaw (CWE-416) in the Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over the network. The issue is remotely reachable with low attack complexity and requires neither privileges nor user interaction (CVSS 3.1 9.8: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Successful exploitation can fully compromise confidentiality, integrity, and availability of the affected host. Windows systems that have the MSMQ Queue Manager component are in scope; the supplied data does not name specific version ranges. CISA has not added this CVE to the Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.

Do: Install the Microsoft security update that addresses CVE-2026-100202 for your Windows builds as soon as it is available. If Message Queuing is not required, remove or disable the MSMQ feature, and block unsolicited network access to MSMQ (notably TCP 1801) from untrusted networks. Check whether the Queue Manager service is installed and which hosts expose it.

CVE-2026-100215 is a heap-based buffer overflow (CWE-122) in the Microsoft Graphics Component. An unauthorized attacker can trigger it locally when a user interacts with malicious content, and no privileges are required beforehand. Successful exploitation can execute arbitrary code with high impact to confidentiality, integrity, and availability on the affected system (CVSS 3.1 base score 7.8). It affects Windows systems that include the Microsoft Graphics Component and were covered by Microsoft's October 2026 security updates; exact version ranges are not stated in the supplied data. It is not in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.

Do: Install Microsoft's October 2026 security updates that patch the Graphics Component on all supported Windows systems, and prioritize endpoints that open untrusted images, documents, or other content that uses that component. Until patches are deployed, reduce exposure by limiting local users' ability to open untrusted graphics content and by applying standard least-privilege controls. There is no public proof-of-concept and the issue is not listed in CISA KEV, but the local code-execution impact still warrants prompt patching.

CVE-2026-100219 is a use-after-free (CWE-416) in Microsoft QUIC that lets an unauthorized attacker execute code over the network. It is remotely reachable with low attack complexity and no privileges or user interaction, and successful exploitation can fully compromise confidentiality, integrity, and availability (CVSS 3.1 base score 9.8). The flaw affects Microsoft QUIC; the provided data does not name specific product builds or version ranges. It is not listed in CISA KEV, and no public proof-of-concept is known.

Do: Apply the Microsoft security update that fixes this QUIC use-after-free as soon as it is available for your Windows or MsQuic deployment, and confirm the patched build is installed. Until then, limit exposure of QUIC (typically UDP 443) to untrusted networks where practical and watch Microsoft guidance for the exact fixed versions.

CVE-2026-100220 is a heap-based buffer overflow (CWE-122) in Microsoft’s Windows Media Video Decoder. A remote, unauthenticated attacker can trigger it by getting a user to process malicious media over the network; user interaction is required and attack complexity is low (CVSS 3.1 8.8, AV:N/AC:L/PR:N/UI:R/S:U). Successful exploitation can run code with high impact on confidentiality, integrity, and availability on the affected system. Windows installations that include this decoder are affected; exact build ranges are not stated in the source data and the flaw was called out in October 2026 Patch Tuesday coverage. It is not on the CISA Known Exploited Vulnerabilities list and no public proof-of-concept is known.

Do: Install the October 2026 Microsoft security updates that fix the Windows Media Video Decoder as soon as they are available for your Windows builds. Until patched, avoid opening untrusted WMV or other media that uses this decoder, including files and links from email or the web, because exploitation requires a user to process attacker-controlled content.

CVE-2026-108471 is an untrusted pointer dereference (CWE-822) in Microsoft Windows Virtualization-Based Security (VBS) Enclave. An attacker who is already authorized to run code locally can trigger the flaw without further user interaction and elevate privileges, with a changed security scope and high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 8.8). It affects Windows systems that include the VBS Enclave component; specific build numbers are not listed in the supplied advisory data and were covered in Microsoft's October 2026 Patch Tuesday updates. Microsoft is the assigning CNA. It is not in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.

Do: Install Microsoft's October 2026 Patch Tuesday security updates for every supported Windows edition that includes Virtualization-Based Security (VBS) Enclave. Until updates are deployed, treat local accounts as a privilege boundary: restrict who can log on interactively, and review systems where VBS is enabled. No public workaround is described in the advisory data.

CVE-2026-102214 is a use-after-free (CWE-416) in Windows Hyper-V. An attacker who is already authorized with low local privileges can trigger the flaw without user interaction and execute code on the host. Successful exploitation yields high impact to confidentiality, integrity, and availability, and the CVSS scope is changed, so the effect can extend beyond the vulnerable Hyper-V component. Windows systems running Hyper-V are affected; exact build ranges were not included in the source data. It is not listed in CISA KEV, and no public proof-of-concept is known.

Do: Apply the October 2026 Microsoft security updates that cover Windows Hyper-V as soon as they are available for your builds. Until hosts are patched, limit local logon to trusted administrators and treat Hyper-V hosts as high-value systems. No public exploit or CISA KEV listing is known, but the issue is high severity with scope change, so patching should not wait on proof-of-concept code.

CVE-2026-102225 is an out-of-bounds read, also associated with a numeric truncation error, in Windows Text Shaping. An unauthorized attacker on the network can trigger it by getting a user to open or render malicious content that exercises the text-shaping component; no privileges are required, but user interaction is. Successful exploitation can lead to remote code execution with high impact to confidentiality, integrity, and availability (CVSS 3.1 base score 8.8). It affects Microsoft Windows systems that include Windows Text Shaping and that are covered by the October 2026 security updates. It is not listed in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.

Do: Install Microsoft's October 2026 Patch Tuesday security updates for every supported Windows client and server as soon as they are available for your builds. Until systems are patched, treat untrusted documents, messages, and web content that force complex text rendering as risky, because exploitation requires a user to open or render attacker-controlled content. Confirm the update is installed and prioritize internet-facing and high-value hosts.

CVE-2026-108131 is a network spoofing flaw (CWE-290, authentication bypass by spoofing) in Microsoft Active Directory Federation Services. An unauthorized remote attacker can trigger it over the network with no user interaction and no prior privileges. Successful exploitation affects integrity only (CVSS 3.1 base score 7.5: high integrity impact, no confidentiality or availability impact), allowing the attacker to spoof identity or authentication rather than run code or crash the service. Organizations that run AD FS for federated sign-in are affected; exact product versions are not stated in the advisory data and are those fixed in Microsoft's October 2026 updates. It is not listed in CISA KEV, and no public proof-of-concept is known.

Do: Apply Microsoft's October 2026 security updates for Active Directory Federation Services and the Windows Server hosts that run it. Until those updates are in place, limit network access to AD FS (especially internet-facing federation endpoints), and review sign-in and federation logs for unexpected authentication or identity-spoofing activity.

CVE-2026-108398 is an untrusted search path flaw (CWE-426) in Microsoft .NET Framework. A locally authorized attacker can exploit it without user interaction to bypass a security feature, with changed scope and high impact to confidentiality, integrity, and availability (CVSS 3.1 base score 8.8). The issue is local only (AV:L, PR:L) and does not by itself grant remote access. It affects systems running the vulnerable .NET Framework builds; exact version ranges were not included in the source data. It is not listed in CISA KEV, and no public proof-of-concept is known; related October 2026 Patch Tuesday reporting describes other Microsoft flaws under attack, not this one.

Do: Install Microsoft's October 2026 security updates that cover .NET Framework on all supported Windows systems as soon as they are available for your release. Until patched, limit local logon rights to trusted accounts and avoid running untrusted binaries from writable directories that could sit earlier in the process search path. No public workaround specific to this CVE is documented in the source data.

CVE-2026-69802 is a weak-authentication flaw (CWE-1390) in Microsoft Network Device Enrollment Service (NDES). An unauthorized attacker can reach a vulnerable NDES service over the network and execute code, with high impact to confidentiality, integrity, and availability; the CVSS 3.1 score is 8.1 because attack complexity is high and no privileges or user interaction are required. NDES is the Windows enrollment service typically deployed with Active Directory Certificate Services for network-device certificate enrollment. The advisory data does not list specific product versions. It is not in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.

Do: Install Microsoft's October 2026 security updates that address CVE-2026-69802 on any server where Network Device Enrollment Service is installed. Until the update is applied, do not expose NDES to untrusted networks and restrict enrollment access to known clients. Confirm whether the NDES role is enabled and review its authentication configuration.

CVE-2026-70250 is a use-after-free flaw (CWE-416), also associated with a race condition (CWE-362), in the Microsoft Windows DHCP Client. An unauthorized attacker on an adjacent network can trigger it without privileges or user interaction (CVSS 3.1 8.8, AV:A/AC:L/PR:N/UI:N/S:U) and gain high-impact code execution on the affected system, with confidentiality, integrity, and availability all rated high. Windows systems that use the built-in DHCP client are in scope; the supplied data does not list specific version ranges and ties the issue to Microsoft's October 2026 Patch Tuesday updates. Exploitation requires adjacency to the target (same local network), not remote internet access alone. It is not listed in CISA KEV, and no public proof-of-concept is known.

Do: Install Microsoft's October 2026 security updates that address CVE-2026-70250 on all supported Windows systems that run the DHCP client. Prioritize devices on shared or untrusted local networks (guest Wi-Fi, branch sites, conference networks), where an adjacent attacker can reach the client without credentials or user interaction. No public exploit or CISA KEV listing was indicated in the supplied data, but the high CVSS score still warrants prompt patching.

CVE-2026-70571 is a stack-based buffer overflow (CWE-121) in Microsoft Exchange Server. An unauthorized attacker can trigger it over the network without user interaction, though the attack complexity is rated high. Successful exploitation can lead to remote code execution with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 8.1). On-premises Exchange deployments are affected; specific version ranges are not given in the supplied data. It is not listed in CISA KEV, and no public proof-of-concept is known.

Do: Apply Microsoft’s October 2026 security updates for Exchange Server as soon as they are available for your deployment. Until patched, limit network exposure of Exchange (especially from the internet), and review mail-server logs for unexpected remote code execution or crash activity. No public proof-of-concept or in-the-wild exploitation is indicated in the provided data.

CVE-2026-88207 is a heap-based buffer overflow (CWE-122) in Microsoft PowerPoint as shipped with Microsoft 365 Apps, Microsoft 365, Office 2021, and Office 2024. An unauthorized attacker can trigger it over a network, but only with user interaction and under conditions Microsoft rates as high attack complexity (CVSS 3.1 base 7.5: AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). Successful exploitation can run the attacker's code in the context of the user who opens the malicious content, with high impact to confidentiality, integrity, and availability. Anyone who uses PowerPoint in those Office and Microsoft 365 products is in scope. It is not listed in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known; the issue was covered in Microsoft's October 2026 Patch Tuesday review.

Do: Install Microsoft's October 2026 security updates for Microsoft 365 Apps, Microsoft 365, Office 2021, and Office 2024 as soon as they are available. Until patched, do not open PowerPoint files from untrusted sources and prefer Protected View for files from email or the web.

CVE-2026-96202 is a heap-based buffer overflow (CWE-122) in Microsoft's Windows Raw Image Extension. A remote attacker can trigger it over the network without prior privileges if a user opens a crafted RAW image (CVSS 3.1 base score 8.8, AV:N/AC:L/PR:N/UI:R). Successful exploitation can give the attacker code execution in the context of the user who opened the file, with high impact to confidentiality, integrity, and availability. Windows systems that have the Raw Image Extension installed are affected; exact build ranges were not included in the CVE record and are covered by Microsoft's October 2026 Patch Tuesday updates. It is not listed in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.

Do: Install Microsoft's October 2026 security updates that patch Windows Raw Image Extension as soon as they are available for your Windows build. Until then, do not open RAW image files from untrusted email, web, or network sources, and prefer viewing such files only after they have been scanned. Confirm the extension is updated via Windows Update or the Microsoft Store and that the host is fully patched.

CVE-2026-96913 is a heap-based buffer overflow (CWE-122) in the Windows kernel. A locally authenticated attacker with low privileges can trigger it without user interaction and elevate privileges, with high impact to confidentiality, integrity, and availability and a changed scope (CVSS 3.1 base score 8.8). Microsoft assigned the CVE; it is covered by the October 2026 Patch Tuesday security updates, but the supplied data does not name exact vulnerable builds. It is not listed in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.

Do: Install Microsoft's October 2026 Patch Tuesday security updates for Windows as soon as they are available for your builds, and reboot so the kernel fix is loaded. Until then, limit local accounts to least privilege and watch for unexpected elevation from low-privilege processes. No public workaround is described in the supplied data.

CVE-2026-96951 is a command-injection flaw (CWE-77) in the Windows Shell in which special elements in a command are not properly neutralized. An unauthorized attacker can trigger it remotely with no prior privileges if a user interacts with attacker-controlled content, and Microsoft describes the result as bypassing a security feature; the CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) rates confidentiality, integrity, and availability impacts as high. Affected products named in the data are Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), Windows Server 2012 and 2016, and Outlook on the web. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-10-13, so exploitation in the wild is confirmed; ransomware use is listed as unknown and no public proof-of-concept is known.

Do: Apply Microsoft's security updates for every listed Windows and Outlook on the web build as soon as they are available, and follow CISA BOD 26-04 (including cloud guidance or discontinuation if a mitigation is unavailable). Prioritize internet-facing and high-value assets, and because exploitation needs user interaction, reinforce phishing-resistant handling of untrusted content while you patch.

CVE-2026-96952 is a heap-based buffer overflow (CWE-122) in Microsoft Windows Media Foundation. An unauthorized attacker can deliver malicious content over a network; if a user interacts with that content, the overflow can let the attacker execute code with the privileges of the affected process. The CVSS 3.1 score is 8.8 (high): network access, low complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability, with unchanged scope. The component is part of Windows and the flaw is covered by Microsoft's October 2026 Patch Tuesday updates, though exact affected version ranges were not stated in the supplied data. It is not in CISA's Known Exploited Vulnerabilities catalog and no public proof-of-concept is known.

Do: Install Microsoft's October 2026 security updates that address CVE-2026-96952 on all supported Windows systems that include Media Foundation. Until those updates are applied, avoid opening media files or streams from untrusted sources, because exploitation requires a user to interact with attacker-supplied content. No public exploit is known and the issue is not listed in CISA's KEV catalog.

CVE-2026-97814 is a critical heap-based buffer overflow (CWE-122) in Microsoft Windows Text Shaping. An unauthorized attacker can trigger it over the network with no privileges and no user interaction (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N). Successful exploitation allows remote code execution with high impact to confidentiality, integrity, and availability on the affected system. Windows installations that include this text-shaping component are in scope, but the CVE record does not name specific builds or version ranges. It is not listed in CISA KEV, and no public proof-of-concept is known.

Do: Install the Microsoft security update that addresses CVE-2026-97814 as soon as it is available for your Windows builds, and prioritize systems that accept untrusted network input that can reach text-shaping code. Until patched, reduce exposure of affected hosts to untrusted networks and monitor for unexpected crashes or code execution in processes that handle text shaping. Confirm the fix from Microsoft’s advisory rather than assuming a specific build or KB, because no version range is given in the CVE data.