Microsoft's October 2026 Patch Tuesday fixes 1,415 flaws, including 85 critical, with one Windows Shell bug exploited in the wild.
Microsoft's October 2026 Patch Tuesday addresses 1,415 vulnerabilities, 85 of them critical, across Windows, Office, Exchange, Hyper-V, and other products. Cisco Talos says CVE-2026-96951, a Windows Shell command-injection flaw scored 8.8, is already exploited. Sixty-seven critical bugs allow remote code execution, including CVSS 9.8 issues in Message Queuing, Microsoft QUIC, Text Shaping, and the PostScript printer driver. Microsoft rates Active Directory CVE-2026-70229 and Exchange CVE-2026-70571 as more likely to be exploited.
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-100202 | Use-after-free RCE in Windows Message Queuing A use-after-free flaw (CWE-416) in the Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over the network. The issue is remotely reachable with low attack complexity and requires neither privileges nor user interaction (CVSS 3.1 9.8: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Successful exploitation can fully compromise confidentiality, integrity, and availability of the affected host. Windows systems that have the MSMQ Queue Manager component are in scope; the supplied data does not name specific version ranges. CISA has not added this CVE to the Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known. Do: Install the Microsoft security update that addresses CVE-2026-100202 for your Windows builds as soon as it is available. If Message Queuing is not required, remove or disable the MSMQ feature, and block unsolicited network access to MSMQ (notably TCP 1801) from untrusted networks. Check whether the Queue Manager service is installed and which hosts expose it. | 9.8 | — |
| large≈10,000–100,000 internet-exposed MSMQ hosts; many more internal Windows systems with the feature enabled |
Microsoft has released its monthly security update for October 2026, which includes 1415 vulnerabilities affecting a range of products, including 85 that Microsoft marked as "critical."
Microsoft notes that 1 of the vulnerabilities disclosed this month have been exploited in the wild
CVE-2026-96951 is a security feature bypass vulnerability that affects Windows Shell. The shared weakness is Improper Neutralization of Special Elements used in a Command ('Command Injection'). The vulnerability has a CVSS base score of 8.8.
Out of 85 "critical" vulnerabilities, 67 are remote code execution (RCE) vulnerabilities.
Microsoft considers exploitation of the following vulnerabilities more likely.
CVE-2026-70229 is a remote code execution vulnerability that affects Windows Active Directory Domain Services. The shared weakness is Incorrect Authorization. The vulnerability has a CVSS base score of 8.1.
CVE-2026-70571 is a remote code execution vulnerability that affects Microsoft Exchange Server. The shared weakness is Stack-based Buffer Overflow. The vulnerability has a CVSS base score of 8.1.
Microsoft considers exploitation of the following vulnerabilities less likely.
CVE-2026-105733, CVE-2026-102214, and CVE-2026-108399 affect Windows Hyper-V. CVE-2026-105733 has an impact of remote code execution; involves Incorrect Initialization of Resource; has a CVSS base score of 8.8. CVE-2026-102214 has an impact of remote code execution; involves Use After Free; has a CVSS base score of 8.8. CVE-2026-108399 has an impact of elevation of privilege; involves Heap-based Buffer Overflow; has a CVSS base score of 7.2.
CVE-2026-100202 is a remote code execution vulnerability that affects Windows Message Queuing Queue Manager. The shared weakness is Use After Free. The vulnerability has a CVSS base score of 9.8.
CVE-2026-100209, CVE-2026-100210, CVE-2026-100211, CVE-2026-97739, CVE-2026-97745, CVE-2026-97755, CVE-2026-97759, CVE-2026-97765, CVE-2026-97778, CVE-2026-97741, CVE-2026-97742, CVE-2026-97753, CVE-2026-97756, CVE-2026-97758, CVE-2026-97761, CVE-2026-97767, CVE-2026-97776, and CVE-2026-97780 are remote code execution vulnerabilities that affect Microsoft Office Excel. Each has a CVSS base score of 8.8. CVE-2026-100209, CVE-2026-100211, CVE-2026-97745, and CVE-2026-97759 involve Use After Free. CVE-2026-100210, CVE-2026-97765 , CVE-2026-97756, CVE-2026-97758, CVE-2026-97776, and CVE-2026-97780 involve Heap-based Buffer Overflow. CVE-2026-97739 involves Heap-based Buffer Overflow and Integer Underflow (Wrap or Wraparound). CVE-2026-97755 involves Out-of-bounds Read. CVE-2026-97778 involves Integer Overflow or Wraparound. CVE-2026-97741 involves Heap-based Buffer Overflow and Off-by-one Error. CVE-2026-97742 involves Stack-based Buffer Overflow. CVE-2026-97753 involves Heap-based Buffer Overflow and Integer Overflow or Wraparound. CVE-2026-97761 involves Stack-based Buffer Overflow. CVE-2026-97767 involves Double Free and NULL Pointer Dereference.
CVE-2026-100215 is a remote code execution vulnerability that affects Microsoft Graphics Component. The shared weakness is Heap-based Buffer Overflow. The vulnerability has a CVSS base score of 7.8.
CVE-2026-100219 and CVE-2026-105016 are remote code execution vulnerabilities that affect Microsoft QUIC. Each has a CVSS base score of 9.8. CVE-2026-100219 involves Use After Free. CVE-2026-105016 involves Heap-based Buffer Overflow.
CVE-2026-100220 is a remote code execution vulnerability that affects Windows Media Video Decoder. The shared weakness is Heap-based Buffer Overflow. The vulnerability has a CVSS base score of 8.8.
CVE-2026-102211, CVE-2026-88074, CVE-2026-108130, CVE-2026-108471, and CVE-2026-96914 are elevation of privilege vulnerabilities that affect Windows Virtualization-Based Security (VBS) Enclave. CVE-2026-102211 involves Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') and Use After Free; has a CVSS base score of 7.0. CVE-2026-88074 involves Integer Overflow or Wraparound; has a CVSS base score of 7.8. CVE-2026-108130 involves Heap-based Buffer Overflow; has a CVSS base score of 7.8. CVE-2026-108471 involves Untrusted Pointer Dereference; has a CVSS base score of 8.8. CVE-2026-96914 involves Heap-based Buffer Overflow and Integer Overflow or Wraparound; has a CVSS base score of 8.8.
CVE-2026-102225 and CVE-2026-97814 are remote code execution vulnerabilities that affect Windows Text Shaping. CVE-2026-102225 involves Numeric Truncation Error and Out-of-bounds Read; has a CVSS base score of 8.8. CVE-2026-97814 involves Heap-based Buffer Overflow; has a CVSS base score of 9.8.
CVE-2026-102855, CVE-2026-102856, and CVE-2026-102857 are remote code execution vulnerabilities that affect Microsoft Office Visio. The shared weakness is Heap-based Buffer Overflow. Each has a CVSS base score of 8.8. CVE-2026-102856 involves Integer Overflow or Wraparound. CVE-2026-102857 involves Off-by-one Error.
CVE-2026-102866 is an elevation of privilege vulnerability that affects Microsoft Office SharePoint. The shared weakness is Improper Verification of Cryptographic Signature. The vulnerability has a CVSS base score of 8.1.
CVE-2026-62840 is an elevation of privilege vulnerability that affects Linux Kernel. The shared weakness is Time-of-check Time-of-use (TOCTOU) Race Condition. The vulnerability has a CVSS base score of 7.0.
CVE-2026-69802 is a remote code execution vulnerability that affects Network Device Enrollment Service (NDES). The shared weakness is Weak Authentication. The vulnerability has a CVSS base score of 8.1.
CVE-2026-70147, CVE-2026-70153, and CVE-2026-108467 are remote code execution vulnerabilities that affect Microsoft PostScript Printer Driver. The shared weakness is Heap-based Buffer Overflow. CVE-2026-70147 has a CVSS base score of 9.8. CVE-2026-70153 has a CVSS base score of 9.8. CVE-2026-108467 has a CVSS base score of 8.8.
CVE-2026-70187 is a remote code execution vulnerability that affects Windows Remote Desktop Services. The shared weakness is Use After Free. The vulnerability has a CVSS base score of 8.1.
CVE-2026-70250 is a remote code execution vulnerability that affects Windows DHCP Client. The shared weakness is Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') and Use After Free. The vulnerability has a CVSS base score of 8.8.
CVE-2026-83934 is a remote code execution vulnerability that affects Windows GDI+. The shared weakness is Stack-based Buffer Overflow. The vulnerability has a CVSS base score of 8.8.
CVE-2026-88073 is an elevation of privilege vulnerability that affects Windows Graphics Kernel. The shared weakness is Use After Free. The vulnerability has a CVSS base score of 8.8.
CVE-2026-88117, CVE-2026-88119, CVE-2026-88120, CVE-2026-88171, and CVE-2026-96934 are remote code execution vulnerabilities that affect Windows DHCP Server. CVE-2026-88117, CVE-2026-88119, and CVE-2026-88120 involve Use After Free; each has a CVSS base score of 8.1. CVE-2026-88171 involves Double Free; has a CVSS base score of 8.1. CVE-2026-96934 involves Use After Free; has a CVSS base score of 9.8.
CVE-2026-96222 and CVE-2026-108131 are spoofing vulnerabilities that affect Active Directory Federation Services (AD FS). CVE-2026-96222 involves Improper Certificate Validation; has a CVSS base score of 7.4. CVE-2026-108131 has a CVSS base score of 7.5.
CVE-2026-96913 is an elevation of privilege vulnerability that affects Windows Kernel. The shared weakness is Heap-based Buffer Overflow. The vulnerability has a CVSS base score of 8.8.
CVE-2026-96952 is a remote code execution vulnerability that affects Microsoft Windows Media Foundation. The shared weakness is Heap-based Buffer Overflow. The vulnerability has a CVSS base score of 8.8.
CVE-2026-105718 is a remote code execution vulnerability that affects Microsoft Excel. The shared weakness is Improper Input Validation and Out-of-bounds Read. The vulnerability has a CVSS base score of 8.8.
CVE-2026-108400 is a remote code execution vulnerability that affects HEVC Video Extensions. The shared weakness is Integer Overflow or Wraparound. The vulnerability has a CVSS base score of 8.8.
CVE-2026-108457 is a remote code execution vulnerability that affects Microsoft Windows PDF. The shared weakness is Out-of-bounds Write. The vulnerability has a CVSS base score of 8.1.
CVE-2026-108460 is a remote code execution vulnerability that affects Windows Message Queuing. The shared weakness is Use After Free. The vulnerability has a CVSS base score of 8.1.
CVE-2026-70215, CVE-2026-88144, CVE-2026-88178, and CVE-2026-88207 are remote code execution vulnerabilities that affect Microsoft Office PowerPoint. CVE-2026-70215 and CVE-2026-88144 involve Use After Free; has a CVSS base score of 8.8. CVE-2026-88178 involves Use After Free; has a CVSS base score of 9.8. CVE-2026-88207 involves Heap-based Buffer Overflow; has a CVSS base score of 7.5.
CVE-2026-70242, CVE-2026-70291, CVE-2026-88156, CVE-2026-97016, and CVE-2026-97749 are remote code execution vulnerabilities that affect Microsoft Office Outlook. Each has a CVSS base score of 9.8. CVE-2026-70242, CVE-2026-70291, and CVE-2026-97016 involve Heap-based Buffer Overflow. CVE-2026-88156 involves Stack-based Buffer Overflow. CVE-2026-97749 involves Double Free.
CVE-2026-70269 and CVE-2026-70300 are remote code execution vulnerabilities that affect Microsoft Office Word. CVE-2026-70269 involves Heap-based Buffer Overflow and Integer Overflow or Wraparound; has a CVSS base score of 8.1. CVE-2026-70300 involves Untrusted Pointer Dereference; has a CVSS base score of 9.8.
CVE-2026-83917 is an elevation of privilege vulnerability that affects Windows ALPC. The shared weakness is Use After Free. The vulnerability has a CVSS base score of 7.0.
CVE-2026-94510 is an elevation of privilege vulnerability that affects Microsoft Bookings. The shared weakness is Authorization Bypass Through User-Controlled Key. The vulnerability has a CVSS base score of 9.9.
CVE-2026-96202 and CVE-2026-96943 are remote code execution vulnerabilities that affect Windows Raw Image Extension. The shared weakness is Heap-based Buffer Overflow. Each has a CVSS base score of 8.8. CVE-2026-96943 involves Integer Overflow or Wraparound.
CVE-2026-96207 is an elevation of privilege vulnerability that affects Microsoft Partner Center. The shared weakness is Improper Certificate Validation. The vulnerability has a CVSS base score of 10.0.
Microsoft considers exploitation of the following vulnerabilities unlikely.
CVE-2026-69789 is a remote code execution vulnerability that affects Windows Reliable Multicast Transport Driver (RMCAST). The shared weakness is Heap-based Buffer Overflow. The vulnerability has a CVSS base score of 7.5.
CVE-2026-88174 is a remote code execution vulnerability that affects Windows Deployment Services. The shared weakness is Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'). The vulnerability has a CVSS base score of 8.1.
CVE-2026-88185 is a remote code execution vulnerability that affects Microsoft Office Word. The shared weakness is Heap-based Buffer Overflow. The vulnerability has a CVSS base score of 8.1.
Other critical vulnerabilities
CVE-2026-69435 is an elevation of privilege vulnerability that affects Azure SRE Agent. The shared weakness is Server-Side Request Forgery (SSRF). The vulnerability has a CVSS base score of 9.6.
CVE-2026-77900 is a remote code execution vulnerability that affects Azure App Service. The shared weakness is Missing Authentication for Critical Function. The vulnerability has a CVSS base score of 9.8.
CVE-2026-83943 is an information disclosure vulnerability that affects Azure API Center. The vulnerability has a CVSS base score of 8.7.
CVE-2026-83947 is a spoofing vulnerability that affects Azure Event Grid. The shared weakness is Missing Authorization. The vulnerability has a CVSS base score of 7.7.
CVE-2026-88131 is a remote code execution vulnerability that affects Microsoft Dataverse. The shared weakness is Deserialization of Untrusted Data. The vulnerability has a CVSS base score of 9.8.
Talos would also like to highlight the following "important" vulnerabilities as Microsoft has determined that their exploitation is "more likely:"
CVE-2026-100214: Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability
CVE-2026-102217: WebDAV Elevation of Privilege Vulnerability
CVE-2026-69673: Windows Update Elevation of Privilege Vulnerability
CVE-2026-69718: Windows Update Elevation of Privilege Vulnerability
CVE-2026-69733: Windows Update Elevation of Privilege Vulnerability
CVE-2026-69783: Windows Update Elevation of Privilege Vulnerability
CVE-2026-69882: Windows Update Elevation of Privilege Vulnerability
CVE-2026-69923: Windows AI Elevation of Privilege Vulnerability
CVE-2026-69926: Desktop Window Manager Elevation of Privilege Vulnerability
CVE-2026-70054: Windows NetBIOS Elevation of Privilege Vulnerability
CVE-2026-70060: Windows Win32k Elevation of Privilege Vulnerability
CVE-2026-70076: Windows Win32k Elevation of Privilege Vulnerability
CVE-2026-70104: Windows Win32k Elevation of Privilege Vulnerability
CVE-2026-70108: Windows Win32k Elevation of Privilege Vulnerability
CVE-2026-70117: Windows Win32k Elevation of Privilege Vulnerability
CVE-2026-70132: Windows Portable Device File System Driver Elevation of Privilege Vulnerability
CVE-2026-70144: Windows Win32k Elevation of Privilege Vulnerability
CVE-2026-70156: Microsoft Windows Search Component Elevation of Privilege Vulnerability
CVE-2026-70218: Windows StateRepository API Elevation of Privilege Vulnerability
CVE-2026-70223: Windows Console Driver Elevation of Privilege Vulnerability
CVE-2026-70233: Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2026-70236: Windows Win32k Elevation of Privilege Vulnerability
CVE-2026-70237: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
CVE-2026-70241: Windows Kerberos Elevation of Privilege Vulnerability
CVE-2026-70245: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
CVE-2026-70249: Windows Win32k Elevation of Privilege Vulnerability
CVE-2026-70253: Windows Win32k Elevation of Privilege Vulnerability
CVE-2026-70255: Desktop Window Manager Elevation of Privilege Vulnerability
CVE-2026-70271: Windows Win32k Elevation of Privilege Vulnerability
CVE-2026-70273: Windows Win32k Elevation of Privilege Vulnerability
CVE-2026-70286: Windows Graphics Component Elevation of Privilege Vulnerability
CVE-2026-70303: Windows Kernel Elevation of Privilege Vulnerability
CVE-2026-72955: Windows Application Compatibility Cache Elevation of Privilege Vulnerability
CVE-2026-81971: Windows NTFS Elevation of Privilege Vulnerability
CVE-2026-83505: Windows Setup Files Cleanup Elevation of Privilege Vulnerability
CVE-2026-83509: Windows Setup Files Cleanup Elevation of Privilege Vulnerability
CVE-2026-83510: Windows Setup Files Cleanup Elevation of Privilege Vulnerability
CVE-2026-83580: Windows Client-Side Caching (CSC) Service Elevation of Privilege Vulnerability
CVE-2026-83669: Windows Error Reporting Elevation of Privilege Vulnerability
CVE-2026-83699: Windows Client-Side Caching (CSC) Service Elevation of Privilege Vulnerability
CVE-2026-83704: Microsoft Windows Search Component Elevation of Privilege Vulnerability
CVE-2026-83717: Windows Installer Elevation of Privilege Vulnerability
CVE-2026-83724: Windows Management Instrumentation Elevation of Privilege Vulnerability
CVE-2026-83732: Win32k Elevation of Privilege Vulnerability
CVE-2026-83735: Windows Kernel Elevation of Privilege Vulnerability
CVE-2026-83738: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
CVE-2026-83750: Windows Error Reporting Elevation of Privilege Vulnerability
CVE-2026-83761: Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
CVE-2026-83763: Windows Input System Elevation of Privilege Vulnerability
CVE-2026-83768: Windows Kernel Elevation of Privilege Vulnerability
CVE-2026-83769: Microsoft OpenSSH for Windows Elevation of Privilege Vulnerability
CVE-2026-83793: Windows Update Orchestrator Service Elevation of Privilege Vulnerability
CVE-2026-83830: Windows COM+ Event System Service Elevation of Privilege Vulnerability
CVE-2026-83834: Windows Kernel-Mode Drivers Elevation of Privilege Vulnerability
CVE-2026-83840: Windows Error Reporting Elevation of Privilege Vulnerability
CVE-2026-83842: Windows TCP/IP Elevation of Privilege Vulnerability
CVE-2026-83848: Windows COM+ Event System Service Elevation of Privilege Vulnerability
CVE-2026-83867: Windows Push Notifications Elevation of Privilege Vulnerability
CVE-2026-83886: Windows Update Orchestrator Service Elevation of Privilege Vulnerability
CVE-2026-83896: Windows Direct Composition Elevation of Privilege Vulnerability
CVE-2026-83899: Windows Installer Elevation of Privilege Vulnerability
CVE-2026-83902: Windows Direct Composition Elevation of Privilege Vulnerability
CVE-2026-83921: Windows Search Service Elevation of Privilege Vulnerability
CVE-2026-84014: Windows Device Association Service Elevation of Privilege Vulnerability
CVE-2026-85355: Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2026-85791: Windows Encrypting File System (EFS) Elevation of Privilege Vulnerability
CVE-2026-85802: Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
CVE-2026-85804: Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
CVE-2026-85832: Windows Background Intelligent Transfer Service (BITS) Elevation of Privilege Vulnerability
CVE-2026-85843: Windows Background Intelligent Transfer Service (BITS) Elevation of Privilege Vulnerability
CVE-2026-85848: Windows Background Intelligent Transfer Service (BITS) Elevation of Privilege Vulnerability
CVE-2026-85849: Windows AppX Deployment Service Elevation of Privilege Vulnerability
CVE-2026-85850: Windows Kernel Elevation of Privilege Vulnerability
CVE-2026-85855: Windows DWM Core Library Elevation of Privilege Vulnerability
CVE-2026-85870: Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2026-85901: Windows Graphics Component Elevation of Privilege Vulnerability
CVE-2026-85908: Windows Graphics Component Elevation of Privilege Vulnerability
CVE-2026-85941: Windows Installer Elevation of Privilege Vulnerability
CVE-2026-85945: Windows Kernel Elevation of Privilege Vulnerability
CVE-2026-88118: Windows Background Intelligent Transfer Service (BITS) Elevation of Privilege Vulnerability
CVE-2026-88133: Windows Portable Device Enumerator Service Elevation of Privilege Vulnerability
CVE-2026-88147: Windows Secure Socket Tunneling Protocol (SSTP) Elevation of Privilege Vulnerability
CVE-2026-88152: Windows Background Intelligent Transfer Service (BITS) Elevation of Privilege Vulnerability
CVE-2026-88159: Windows Background Intelligent Transfer Service (BITS) Remote Code Execution Vulnerability
CVE-2026-88191: Microsoft Windows Search Component Elevation of Privilege Vulnerability
CVE-2026-96858: Windows Security Account Manager Tampering Vulnerability
CVE-2026-96911: Microsoft Windows Search Component Elevation of Privilege Vulnerability
CVE-2026-96929: Windows Kernel Elevation of Privilege Vulnerability
CVE-2026-96940: Microsoft Exchange Server Elevation of Privilege Vulnerability
CVE-2026-69452: Windows Enterprise App Management Elevation of Privilege Vulnerability
CVE-2026-69880: Desktop Window Manager Elevation of Privilege Vulnerability
CVE-2026-69918: Windows Core Messaging Elevation of Privilege Vulnerability
CVE-2026-70103: Windows Error Reporting Elevation of Privilege Vulnerability
CVE-2026-70106: Windows Kernel Elevation of Privilege Vulnerability
CVE-2026-70151: Windows Direct Composition Elevation of Privilege Vulnerability
CVE-2026-70176: Windows Win32k Elevation of Privilege Vulnerability
CVE-2026-70279: Microsoft Exchange Server Spoofing Vulnerability
CVE-2026-83785: Windows COM+ Event System Service Elevation of Privilege Vulnerability
CVE-2026-83927: Windows Registry Elevation of Privilege Vulnerability
CVE-2026-85884: Windows Health and Optimized Experiences Service Elevation of Privilege Vulnerability
CVE-2026-85902: Windows Direct Composition Elevation of Privilege Vulnerability
CVE-2026-85906: Windows Direct Composition Elevation of Privilege Vulnerability
CVE-2026-88093: Desktop Window Manager Elevation of Privilege Vulnerability
CVE-2026-96939: Servicing Stack Updates Elevation of Privilege Vulnerability
CVE-2026-97798: Windows Error Reporting Service Elevation of Privilege Vulnerability
CVE-2026-97799: Windows Audio Service Elevation of Privilege Vulnerability
CVE-2026-97800: Windows Mobile Broadband Elevation of Privilege Vulnerability
A complete list of all the other vulnerabilities Microsoft disclosed this month is available on its update page.
In response to these vulnerability disclosures, Talos is releasing a new Snort ruleset that detects attempts to exploit some of them. Please note that additional rules may be released at a future date, and current rules are subject to change pending additional information. Cisco Secure Firewall customers should use the latest update to their ruleset by updating their SRU. Open-source Snort Subscriber Ruleset customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.
Snort 2 rule coverage: 1:67210 - 1:67273, 1:67276 - 1:67279, 1:67282 - 1:67311, 1:67313 - 1:67316, 1:67319 - 1:67322
Snort 3 rule coverage: 1:301663 - 1:301694, 1:301696, 1:301702 - 1:301703, 1:301705 - 1:301706, 1:301709, 1:301711, 1:301717 - 1:301718
Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/microsoft-patch-tuesday-for-october-2026/
| CVE-2026-100209 | Use-after-free code execution in Microsoft Excel CVE-2026-100209 is a use-after-free (CWE-416) in Microsoft Excel that lets an unauthorized attacker execute code with the privileges of the user who opens a crafted workbook. Delivery is over a network, but exploitation requires user interaction; complexity is low and no prior privileges are required (CVSS 3.1 base score 8.8). Successful exploitation can fully compromise confidentiality, integrity, and availability of the affected client. Microsoft 365 Apps, Microsoft 365, Office 2021, and Office 2024 are listed as affected; exact build ranges are not in the source data. It is not in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known. Do: Install Microsoft's October 2026 security updates for Excel in Microsoft 365 Apps, Microsoft 365, Office 2021, and Office 2024 as soon as they are available for your channel. Until patched, do not open Excel files from untrusted senders or sites, and prefer Protected View for internet-sourced workbooks. No public exploit or CISA KEV listing is known; still treat unpatched Excel clients as high priority because the issue is rated high severity with remote delivery and full impact if a user opens a malicious file. | 8.8 | — |
| massOn the order of hundreds of millions of Microsoft 365 and Office users who run Excel |
| CVE-2026-100215 | Heap buffer overflow in Microsoft Graphics Component CVE-2026-100215 is a heap-based buffer overflow (CWE-122) in the Microsoft Graphics Component. An unauthorized attacker can trigger it locally when a user interacts with malicious content, and no privileges are required beforehand. Successful exploitation can execute arbitrary code with high impact to confidentiality, integrity, and availability on the affected system (CVSS 3.1 base score 7.8). It affects Windows systems that include the Microsoft Graphics Component and were covered by Microsoft's October 2026 security updates; exact version ranges are not stated in the supplied data. It is not in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known. Do: Install Microsoft's October 2026 security updates that patch the Graphics Component on all supported Windows systems, and prioritize endpoints that open untrusted images, documents, or other content that uses that component. Until patches are deployed, reduce exposure by limiting local users' ability to open untrusted graphics content and by applying standard least-privilege controls. There is no public proof-of-concept and the issue is not listed in CISA KEV, but the local code-execution impact still warrants prompt patching. | 7.8 | — |
| massOn the order of hundreds of millions to over a billion Windows installations (estimate) |
CVE-2026-100219+1 related CVE | Use-after-free remote code execution in Microsoft QUIC CVE-2026-100219 is a use-after-free (CWE-416) in Microsoft QUIC that lets an unauthorized attacker execute code over the network. It is remotely reachable with low attack complexity and no privileges or user interaction, and successful exploitation can fully compromise confidentiality, integrity, and availability (CVSS 3.1 base score 9.8). The flaw affects Microsoft QUIC; the provided data does not name specific product builds or version ranges. It is not listed in CISA KEV, and no public proof-of-concept is known. Do: Apply the Microsoft security update that fixes this QUIC use-after-free as soon as it is available for your Windows or MsQuic deployment, and confirm the patched build is installed. Until then, limit exposure of QUIC (typically UDP 443) to untrusted networks where practical and watch Microsoft guidance for the exact fixed versions. | 9.8 | — |
| — |
| CVE-2026-100220 | Heap Buffer Overflow in Windows Media Video Decoder CVE-2026-100220 is a heap-based buffer overflow (CWE-122) in Microsoft’s Windows Media Video Decoder. A remote, unauthenticated attacker can trigger it by getting a user to process malicious media over the network; user interaction is required and attack complexity is low (CVSS 3.1 8.8, AV:N/AC:L/PR:N/UI:R/S:U). Successful exploitation can run code with high impact on confidentiality, integrity, and availability on the affected system. Windows installations that include this decoder are affected; exact build ranges are not stated in the source data and the flaw was called out in October 2026 Patch Tuesday coverage. It is not on the CISA Known Exploited Vulnerabilities list and no public proof-of-concept is known. Do: Install the October 2026 Microsoft security updates that fix the Windows Media Video Decoder as soon as they are available for your Windows builds. Until patched, avoid opening untrusted WMV or other media that uses this decoder, including files and links from email or the web, because exploitation requires a user to process attacker-controlled content. | 8.8 | — |
| massOn the order of hundreds of millions to over 1 billion Windows devices that include the built-in media decoder |
| CVE-2026-102211 | Use-after-free local privilege elevation in Windows VBS Enclave CVE-2026-102211 is a use-after-free flaw (also associated with a race condition) in Windows Virtualization-Based Security (VBS) Enclave. An attacker who is already authorized locally can trigger the bug to elevate privileges on the same system; attack complexity is high, no user interaction is required, and the impact is high for confidentiality, integrity, and availability. It affects Microsoft Windows systems that include the vulnerable VBS Enclave component; exact build ranges were not stated in the source data and the issue was covered in October 2026 Patch Tuesday reviews. It is not listed in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known. Do: Apply Microsoft's October 2026 security updates for Windows as soon as they are available for your builds. Prioritize systems where low-privileged local users are not fully trusted, especially those with Virtualization-Based Security enabled. There is no public workaround in the source data; patching is the concrete fix. | 7.0 | — |
| massUnknown exact count; plausibly tens to hundreds of millions of Windows installations ship related VBS components, with a smaller subset actually using VBS… |
CVE-2026-102214+2 related CVEs | Use-after-free in Windows Hyper-V enables local code execution CVE-2026-102214 is a use-after-free (CWE-416) in Windows Hyper-V. An attacker who is already authorized with low local privileges can trigger the flaw without user interaction and execute code on the host. Successful exploitation yields high impact to confidentiality, integrity, and availability, and the CVSS scope is changed, so the effect can extend beyond the vulnerable Hyper-V component. Windows systems running Hyper-V are affected; exact build ranges were not included in the source data. It is not listed in CISA KEV, and no public proof-of-concept is known. Do: Apply the October 2026 Microsoft security updates that cover Windows Hyper-V as soon as they are available for your builds. Until hosts are patched, limit local logon to trusted administrators and treat Hyper-V hosts as high-value systems. No public exploit or CISA KEV listing is known, but the issue is high severity with scope change, so patching should not wait on proof-of-concept code. | 8.8 group max | — |
| largeOn the order of hundreds of thousands to low millions of Hyper-V-enabled hosts |
| CVE-2026-70229 | Incorrect authorization RCE in Active Directory Domain Services CVE-2026-70229 is an incorrect-authorization flaw (CWE-863) in Microsoft Active Directory Domain Services. A remote, unauthenticated attacker can exploit it over the network without user interaction, though Microsoft rates attack complexity as high (CVSS 3.1 base score 8.1). Successful exploitation can lead to code execution with high impact on confidentiality, integrity, and availability of the affected domain controller, with unchanged scope. It affects organizations that run Active Directory Domain Services; exact product builds are not stated in the source data and are covered by the October 2026 Microsoft updates. It is not listed in CISA KEV, and no public proof-of-concept is known. Do: Install Microsoft's October 2026 security updates on every domain controller that runs Active Directory Domain Services, then confirm the update applied. Until patching is complete, keep domain controllers off the internet, restrict which networks can reach AD protocols, and watch for unexpected remote code execution or privilege changes. | 8.1 | — |
| massOn the order of millions of domain controllers and well over 1 million dependent users (estimate; exact count unknown) |
| CVE-2026-70571 | Network stack buffer overflow RCE in Microsoft Exchange CVE-2026-70571 is a stack-based buffer overflow (CWE-121) in Microsoft Exchange Server. An unauthorized attacker can trigger it over the network without user interaction, though the attack complexity is rated high. Successful exploitation can lead to remote code execution with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 8.1). On-premises Exchange deployments are affected; specific version ranges are not given in the supplied data. It is not listed in CISA KEV, and no public proof-of-concept is known. Do: Apply Microsoft’s October 2026 security updates for Exchange Server as soon as they are available for your deployment. Until patched, limit network exposure of Exchange (especially from the internet), and review mail-server logs for unexpected remote code execution or crash activity. No public proof-of-concept or in-the-wild exploitation is indicated in the provided data. | 8.1 | — |
| largeOn the order of tens of thousands of internet-exposed Exchange servers |
| CVE-2026-96951 | Windows Shell command injection bypasses a security feature CVE-2026-96951 is a command-injection flaw (CWE-77) in the Windows Shell in which special elements in a command are not properly neutralized. An unauthorized attacker can trigger it remotely with no prior privileges if a user interacts with attacker-controlled content, and Microsoft describes the result as bypassing a security feature; the CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) rates confidentiality, integrity, and availability impacts as high. Affected products named in the data are Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), Windows Server 2012 and 2016, and Outlook on the web. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-10-13, so exploitation in the wild is confirmed; ransomware use is listed as unknown and no public proof-of-concept is known. Do: Apply Microsoft's security updates for every listed Windows and Outlook on the web build as soon as they are available, and follow CISA BOD 26-04 (including cloud guidance or discontinuation if a mitigation is unavailable). Prioritize internet-facing and high-value assets, and because exploitation needs user interaction, reinforce phishing-resistant handling of untrusted content while you patch. | 8.8 | 2% | KEV |
| masson the order of hundreds of millions of Windows endpoints and Outlook on the web users | KEV |