October 2026 Patch Tuesday: 1,404 Fixes and an Exploited MOTW Bypass

Key stats: 1,404 fixes in total

• Critical: 77
• Important: 1,317
• Moderate: 3
• Low: 1
• Weaponized: 1

This month’s release is yet another record, roughly 400 more fixes than September.  It covers Windows, Office, Outlook, Exchange, SharePoint, SQL Server, Hyper-V, Active Directory, Kerberos and a long list of Azure services.  77 Critical vulnerabilities is plenty to work through, and a few carry a perfect or near-perfect CVSS score of 10.0 or 9.9.  Naturally, that’s where the eye goes first, but the one vulnerability Microsoft confirms is already being exploited isn’t Critical at all.  It’s rated Important.

Regular readers will know where I’m going with this.  A CVSS score tells you how bad a vulnerability is in isolation.  It doesn’t tell you where that vulnerability sits in an attack chain, the sequence of steps an attacker takes to turn a foothold into full control.  Last month the exploited bug was a privilege elevation, a step that comes after initial access.  This month it’s a bypass of a security warning on files, a step that sits at the delivery stage.

CVE-2026-96951 is a Windows Shell Security Feature Bypass vulnerability, caused by improper neutralization of special elements in a command, a classic command injection flaw.  Microsoft has detected exploitation but it isn’t publicly disclosed.  The security feature being bypassed is Mark of the Web (MOTW), the marker Windows attaches to files that arrive from the internet so that protections can treat them with suspicion.  Microsoft’s guidance says an attacker would send a crafted file by email or instant message and convince the user to take action.  The user does still have to act, but a defense designed to make them think twice is the thing that’s been bypassed.

It scores 8.8, so unlike last month’s bug it does have a CVSS score but it still sits well below the 9.8s and 10.0s in a list sorted by severity.  If you sort by what attackers are doing right now, it’s at the top.

The 9.8 that isn’t labeled Critical

Separately from the exploited bug, CVE-2026-85844 deserves a look.  It’s a Windows Kerberos Elevation of Privilege vulnerability, scoring 9.8, rated Important, and flagged by Microsoft as Exploitation More Likely. Microsoft’s guidance says an unauthenticated attacker could send crafted Kerberos authentication traffic and relay the result to a domain controller, gaining SYSTEM on it, with no user interaction required.  It isn’t confirmed as exploited, and Microsoft doesn’t spell out the network position an attacker needs but a path to SYSTEM on a domain controller sitting below the Critical label is exactly the kind of bug a severity-sorted queue pushes down the list.

CVE-2026-70229 is a Critical Active Directory Domain Services Remote Code Execution vulnerability, also flagged Exploitation More Likely.  Microsoft says an unauthenticated attacker could send a specially crafted packet over the network, with no user interaction.  The attack complexity is rated High, and exploitation depends on specific network conditions and timing, so it isn’t reliable in every environment.

Exchange is back

Exchange has ten CVEs this month, and three are worth calling out:

• CVE-2026-70571 is a Critical Remote Code Execution vulnerability, scoring 8.1.  Microsoft says an unauthenticated attacker could send a crafted email to the server and trigger an internal content-conversion process, with no user interaction.  Complexity is High, and Microsoft says the attacker needs a deep understanding of the target environment but it’s flagged Exploitation More Likely.
• CVE-2026-96940 is an Elevation of Privilege vulnerability in Outlook Web Access, also More Likely.  An authenticated attacker could gain access to other users’ mailboxes within the same organization and read email and attachments.  Exchange Online has already been fixed service-side, so this one is for on-premises customers.
• CVE-2026-70279 is a cross-site scripting Spoofing vulnerability, scoring 9.3.  If an administrator clicks a crafted link, the attacker can act with that administrator’s privileges.

If you run on-premises Exchange, patch the full set rather than cherry-picking the highest score.

The Preview Pane, still an attack vector!

It wouldn’t be a Patch Tuesday post without it. 20 Office vulnerabilities this month carry Microsoft’s note that the Preview Pane is an attack vector, 9 Critical and 11 Important, spanning Outlook, Word and PowerPoint. That means previewing a malicious file, with no further click, is enough to trigger the flaw. It’s a low-friction route onto an endpoint, which is exactly what the first stage of an attack needs.

Worth noting: the 10.0s that need nothing from you

The highest scores of the month are already fully mitigated by Microsoft on the service side. CVE-2026-96207 (Partner Center EoP, 10.0), CVE-2026-94510 (Bookings EoP, 9.9) and CVE-2026-69435 (Azure SRE Agent EoP, 9.6) need no customer action. The same goes for the 9.8s in Azure App Service (CVE-2026-77900) and Microsoft Dataverse (CVE-2026-88131). They’re worth knowing about for risk reporting, but they shouldn’t compete with your patch cycle this week.

Special mention: plausible chains

Both combinations below are my speculation.  The CVEs are real and the descriptions are Microsoft’s, but Microsoft has not linked them, and none is confirmed as exploited together.

Exchange, from email to admin. CVE-2026-70571 is reached by an unauthenticated email.  CVE-2026-70279 needs a social-engineered admin click.  CVE-2026-96940 needs an authenticated attacker.  It’s plausible that an attacker could use more than one of them against the same organization, but each has its own preconditions, and I haven’t verified that the output of one satisfies the input of another.

Hyper-V and VBS.  CVE-2026-102214 and CVE-2026-105733 are both Critical Hyper-V Remote Code Execution vulnerabilities, each scoring 8.8.  A low-privileged attacker running a crafted application inside a guest VM can execute code on the host.  CVE-2026-105733 is the nested virtualization case, where the escape lands on the guest acting as the host.  Separately, CVE-2026-96914 is a Critical Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege vulnerability.  VBS is the isolation layer behind protections such as Credential Guard.  A guest-to-host escape alongside a VBS enclave bug is worth ruling out if you run shared Hyper-V infrastructure.

How to be the hero this month: don’t follow the score alone!

1. Patch CVE-2026-96951 without delay.  It’s already being exploited, regardless of its Important rating.  Severity labels describe potential impact.  Exploitation status describes what’s happening.
2. Patch the Exchange set together if you run it on premises.
3. Treat the Preview Pane as a live attack vector.  Keep attachment filtering and Attack Surface Reduction rules current and consider whether Preview Pane needs to be on by default for every user group.
4. Ask what an attacker does next, not just what CVSS says now.
5. If you run shared Hyper-V infrastructure, review the guest-to-host and VBS items above.  They aren’t a confirmed chain, but the individual pieces are real.
6. Most importantly, prioritize resilience alongside prevention.  When prevention fails, recovery speed is what limits downtime.  Absolute enables organizations to rapidly restore compromised endpoints at scale using firmware-embedded Absolute Persistence® and automated Absolute Rehydrate® capabilities, helping reduce downtime and operational strain during major incidents.

Patch smart. Build resilience. Happy patching.

See the October 2026 Patch Tuesday Chart (PDF).

Kindregards,

Rob