Microsoft's October 2026 Patch Tuesday fixes 1,413 CVEs, including an exploited Windows Shell zero-day.
Microsoft's October 2026 Patch Tuesday addresses 1,413 CVEs, including 80 critical flaws, exceeding September's 974. Two zero-days are security bypasses: actively exploited CVE-2026-96951 (CVSS 8.8) in Windows Shell, and CVE-2026-108398 in .NET Framework. Windows accounts for 1,102 flaws, with others affecting Office, developer tools, SharePoint, SQL Server, Exchange, Azure, and Defender. Microsoft also republished CVE-2026-21413, a Cisco Talos raw-image-extension remote code execution vulnerability. Fortra noted that 26 Microsoft CVEs from 2026 appear in CISA's Known Exploited Vulnerabilities catalog.
October's update covers 1,413 CVEs, including 80 critical flaws
CVE-2026-96951 in Windows Shell is actively exploited
CVE-2026-108398 is a separate .NET Framework security bypass
Windows accounts for 1,102 of the disclosed flaws
Republished CVE-2026-21413 is a raw-image-extension RCE
itical-zero-click-bugs#recipe=similar-items&sourcecontentid=7b70e2514592f68b16486d247d566d50) Patch Now: Microsoft Flags Zero-Day & Critical Zero-Click
md5
d705cceb54d730025cbc964fce146066
tch-windows-server-bug#recipe=similar-items&sourcecontentid=d705cceb54d730025cbc964fce146066) Microsoft Issues Emergency Patch for Critical Windows Ser
Full article2,334 words · extracted from darkreading.com · click to collapse
CVE-2026-108398 is an untrusted search path flaw (CWE-426) in Microsoft .NET Framework. A locally authorized attacker can exploit it without user interaction to bypass a security feature, with changed scope and high impact to confidentiality, integrity, and availability (CVSS 3.1 base score 8.8). The issue is local only (AV:L, PR:L) and does not by itself grant remote access. It affects systems running the vulnerable .NET Framework builds; exact version ranges were not included in the source data. It is not listed in CISA KEV, and no public proof-of-concept is known; related October 2026 Patch Tuesday reporting describes other Microsoft flaws under attack, not this one.
Do: Install Microsoft's October 2026 security updates that cover .NET Framework on all supported Windows systems as soon as they are available for your release. Until patched, limit local logon rights to trusted accounts and avoid running untrusted binaries from writable directories that could sit earlier in the process search path. No public workaround specific to this CVE is documented in the source data.
8.8
—
Microsoft .NET Framework
massHundreds of millions of Windows installations that include .NET Framework (order-of-magnitude estimate)
A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545 and Commit d20315b
A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
Windows Shell command injection bypasses a security feature
CVE-2026-96951 is a command-injection flaw (CWE-77) in the Windows Shell in which special elements in a command are not properly neutralized. An unauthorized attacker can trigger it remotely with no prior privileges if a user interacts with attacker-controlled content, and Microsoft describes the result as bypassing a security feature; the CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) rates confidentiality, integrity, and availability impacts as high. Affected products named in the data are Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), Windows Server 2012 and 2016, and Outlook on the web. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-10-13, so exploitation in the wild is confirmed; ransomware use is listed as unknown and no public proof-of-concept is known.
Do: Apply Microsoft's security updates for every listed Windows and Outlook on the web build as soon as they are available, and follow CISA BOD 26-04 (including cloud guidance or discontinuation if a mitigation is unavailable). Prioritize internet-facing and high-value assets, and because exploitation needs user interaction, reinforce phishing-resistant handling of untrusted content while you patch.
Zero-Days Lurk in Microsoft's Overgrown October Patch Tuesday
The scary surprises in the largest security update ever include security bypasses and unauthenticated RCEs.
Tara Seals,Managing Editor, News,Dark Reading
October 13, 2026
7 Min Read
Source: China Photos via Getty Images
As we progress further into the AI-driven "vulnpocalypse era," Microsoft's October 2026 Patch Tuesday security update blows past last month's record for the number of vulnerabilities addressed, disclosing 1,413 Microsoft CVEs.
Among these are 80 critical flaws and two zero-day bugs, one under active exploitation. In comparison, September's update included 974 CVEs, which seemed staggering enough.
And yet, security experts are urging teams to ignore the size of the update, and instead focus on exploitable risk, and getting processes, tools, and people into place to be able to reduce that risk.
"Recently, I've argued that numbers are meaningless," said Tyler Reguly, associate director for security R&D at Fortra, in public emailed comments. "This month's number, 1,413, is no different. There are, however, numbers that hold meaning. Twenty-six, for example, is how many 2026 Microsoft CVEs have shown up in the CISA Known Exploited Vulnerabilities catalog. Last year, that number was 30, and the year before was 32. That means less than 1% of vulnerabilities patched by Microsoft this year are known to be exploited."
In terms of what's lurking inside this month's bumper crop of bugs, Windows harvested the lion's share of the security flaws listed — accounting for 1,102 of them, to be exact. That's followed by 134 for Office, 61 in Developer Tools (Dev Div), 36 for SharePoint Server, 22 for SQL Server, seven for Exchange Server, 15 in Azure, and four in Defender. Thirty-two are found in various "other" categories.
L o a d i n g...
Microsoft also republished a Cisco Talos bug, CVE-2026-21413, which is listed as a raw image extension remote code execution (RCE) vulnerability.
Both of the zero-days are potentially scary security bypasses. CVE-2026-96951 (CVSS 8.8) is the one under active exploit, found in Windows Shell. The other is CVE-2026-108398, found in .NET Framework Security.
The exploited bug, uncovered by Anthropic's Claude AI, targets the Mark of the Web (MOTW) tag that Windows applies to files downloaded from the Internet; it classifies how dangerous those files might be. As Automox researchers explained, it allows an attacker to craft files sent to users in such a way that bypasses MOTW — and the downstream security checks that rely on it, including SmartScreen, Office Protected View, the Office block on macros, Smart App Control on Windows 11, and the Attachment Manager prompt.
"MOTW is like the sticker on a package in that every guard in the building checks the sticker, not the package [itself]," the researchers explained in their blog post on the October update. "This bug delivers the package without [a sticker]. The result is a file that opens as though the user created it locally. No warning dialog, no read-only view, no macro block. One bug turns off several controls at once."
CVE-2026-108398 (CVSS 8.8), meanwhile, is less concerning; it needs local access and a low-privilege account, and Microsoft assesses it as "exploitation less likely."
"The flaw is an untrusted search path in .NET Framework," according to Automox. "An attacker places a crafted .NET assembly on the endpoint and registers it to load in a protected process, then runs code inside that process without tripping Windows Defender Application Control (WDAC)."
Mike Walters, president and co-founder of Action1, said the vulnerability is particularly dangerous as a post-compromise attack technique.
"Successful exploitation could compromise system integrity, expose sensitive business information, weaken endpoint defenses, and disrupt critical operations," he explained in Action1's blog on the update. "Although active exploitation remains unconfirmed and exploit code maturity is unproven, public disclosure … increases urgency. With no official workaround available, prioritize deployment of Microsoft's applicable security updates across affected Windows endpoints and servers, especially WDAC-protected environments, and monitor unpatched systems for suspicious assembly loading and unauthorized execution."
One vulnerability that Automox researchers also flagged is a critical Reading Pane RCE in Outlook, tracked as CVE-2026-70242 (CVSS 9.8).
Attackers can craft an email that triggers a heap-based buffer overflow when Outlook shows it in the Reading Pane; there's no need to open the message, authenticate, or interact in any way for exploitation to occur.
"Preview-pane bugs surface every few years, and they draw attention because email is the front door," the researchers warned. "Addresses are easy to find in breach dumps and on company websites, so targeting costs an attacker almost nothing."
Dustin Childs, head of threat awareness for the Zero Day Initiative (ZDI) at TrendAI, warned security teams about CVE-2026-102866 (CVSS 8.1), a Microsoft Office SharePoint elevation of privilege vulnerability.
"It's an improper cryptographic signature verification bug," Childs said in his monthly patch review. "An attacker who obtains a valid proof token for a targeted user could modify it, submit it to the server, and authenticate as that user. The only caveat is that the attacker has to obtain that token first, but there are multiple methods this could be achieved."
He also noted CVE-2026-65674 (CVSS 8.8), which is a Microsoft SQL Server RCE bug, as having "the best exploitability rating of any SQL Server bug this month. It’s a deserialization of untrusted data. An authenticated attacker connects to an affected SQL Server and sends a specially crafted request to run code on the server. No user interaction is needed. Definitely check this on any SQL Server directly connected to the Internet."
Another concerning bug that's ripe for prioritization is a heap-based buffer overflow RCE flaw in Microsoft QUIC, tracked as CVE-2026-105016 (CVSS score 9.8). It could allow an unauthenticated attacker to execute malicious code on affected systems over a network, and affects multiple Microsoft products, including Windows 11, Windows Server, .NET, and Visual Studio.
"An attacker could exploit this weakness by sending a specially crafted network packet to an affected service, potentially gaining control of the targeted system without requiring authentication or user interaction," Jack Bicer, director of vulnerability research at Action1, said in the company's blog post. "Successful exploitation could let attackers run malicious code and take control of affected services, exposing or altering sensitive business and customer data, disrupting operations, and leaving organizations with recovery costs and damaged customer trust."
In addition to these specific vulnerabilities, Nightwing experts provided some general guidance for dealing with the monster that is Microsoft's October Patch Tuesday update:
"Microsoft: Patch Exchange, .NET, and Windows 11 without waiting for routine maintenance windows. Apply the October 2 Exchange update for CVE‑2026‑96940 on all on‑prem and hybrid servers, verify .NET Framework runtimes receive the current RCE‑bearing fixes and reboots, and move Windows 11 24H2 Home/Pro off their final security update by starting migrations and testing VPN, VDI, storage, and Secure Boot paths now."
"Exchange Server: Four Exchange Server security updates (KB5129955/56/57/58) each address a single High‑severity CVE with a CVSS 8.8 score across Exchange 2016, 2019, and Subscription Edition. Given Exchange’s history as a high‑value target, treat these as near‑critical: prioritize rapid testing, deployment, and verification for all exposed servers."
"Windows 11: Cumulative updates KB5127648 and KB5126653 advance Windows 11 24H2, 25H2, 26H2, and 23H2 to aligned build trains, with essentially the same security content across branches. Treat these as mandatory security baselines rather than optional feature waves and confirm that your patch compliance reporting is tracking build numbers, not just KB presence."
AI Continues to Add Horror Chills to Patch Tuesday Releases
Microsoft's escalating Patch Tuesday numbers are emblematic of a broader reality of monthly CVE disclosures rising sharply; they've grown in volume by 145% over two years according to one analysis from Echo, from 3,173 in June 2024 to 7,765 in June 2026.
There are a few reasons for this: It's partly due to the expansion of CVE programs in general, according to Echo's analysis, but also, of course, increasingly because of AI-assisted vulnerability discovery. On an annual basis, CVE disclosures shot up from 30,949 in 2023 to 49,979 in 2025 and, based on the numbers so far, 2026 is clearly on track to surpass even that number. The question is, how are security teams to handle the increased workload?
"Is AI to blame? Partly," said ZDI's Childs. "It's accelerating bug-hunting on both sides of the fence, so vendors are finding (and fixing) more flaws, and researchers are finding them faster too. But AI isn't creating these bugs out of thin air. It’s just shortening the time between a vulnerability existing and someone noticing it."
As Fortra's Reguly implied, Childs said that security teams simply need to adapt. "What matters is that discovery is scaling faster than exploitation, so teams that triage by sheer CVE count instead of exploitability are burning cycles on the wrong bugs," he said. "Patch what's proven, prioritized, and public, and treat everything else as this month's new normal."
Tara Seals is an award-winning journalist with 25+ years of experience as a reporter, analyst, and editor in the cybersecurity, communications, and technology spaces. As managing editor, she runs the newsroom at Dark Reading, leading a team of staff writers and freelance contributors. She also heads up strategy for a variety of in-depth, multichannel news coverage initiatives.
Prior to joining Dark Reading in 2022, Tara was editor-in-chief at cybersecurity stalwart Threatpost, and prior to that, the North American news lead for Infosecurity Magazine. She also spent 13 years working for other titles at Virgo Publishing (now part of Informa TechTarget), as executive editor and editor-in-chief at publications focused on communications service providers, channel partners, and enterprise mobile and video technology. In 2026, she was awarded a regional Azbee award for her in-depth coverage of the ongoing North Korean fake worker cyber campaign.
A Texas native, she holds a B.A. from Columbia University, lives in Western Massachusetts with her family, and is on a never-ending quest for good Mexican food in the Northeast.
Want more Dark Reading stories in your Google search results?
Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.
Informa TechTarget|
