October Patch Day: Microsoft Patches 1,414 Holes — One Already Exploited

TVS News AI, editorially supervised, presents October Patch Day: Microsoft Patches 1,414 Holes — One Already Exploited.

Microsoft has set a new record on October Patch Day: 1,413 security vulnerabilities are being closed by the company in its products — more than ever before in a single month. October even surpasses the previous month of September, which saw 999 vulnerabilities. Around 70 of these are classified by Microsoft as critical, with nearly all the rest rated important. One of these flaws is already being actively exploited, according to Golem — and that was before the update was distributed.

The actively exploited flaw bypasses the download warning

It involves CVE-2026-96951 in the Windows Shell with a CVSS score of 8.8. The vulnerability stems from a command injection: the shell does not properly neutralize special characters in a command. With a crafted file or link, attackers can bypass the so-called Mark of the Web (MotW) — the marker by which Windows identifies files from the internet and displays a warning before opening them. The attack does, however, require a user to actually open the file or follow the link. The US agency CISA added the security vulnerability to its catalog of known exploited vulnerabilities on October 13, 2026; for US federal agencies, the deadline to close it expires on October 16, 2026 — administrators should distribute this update first accordingly.

Known in advance: .NET and MessagePack-CSharp

Two further vulnerabilities were already publicly known before Patch Day. CVE-2026-108398 in the .NET Framework also carries a CVSS score of 8.8: an authenticated attacker can place a crafted .NET assembly, register it to be loaded by a protected process, and bypass Windows Defender Application Control (WDAC) — the policy for permitted programs — via an unsafe search path to execute code within the protected process. CVE-2026-92707 in the third-party library MessagePack-CSharp (CVSS 5.3) allows disrupting network services without authentication via an uncontrolled memory allocation. Microsoft reports no concrete attacks for any of the three previously known vulnerabilities.

Nearly 60 vulnerabilities are wormable

An unusually large portion of the October vulnerabilities can be exploited over the network without authentication and without user action — Microsoft describes this pattern for nearly 60 vulnerabilities, which are therefore considered wormable. Four of them carry the maximum CVSS score of 9.8: CVE-2026-96934 in the DHCP Server, CVE-2026-100219 and CVE-2026-105016 in Microsoft QUIC, and CVE-2026-97814 in Windows Text Shaping. In the Network Policy Server (NPS), which checks VPN and Wi-Fi logins as a RADIUS server, CVE-2026-100222 (heap buffer overflow) and CVE-2026-85806 (integer underflow) also reach 9.8 — but Microsoft classifies both as "only" important rather than critical. A crafted print job can additionally trigger CVE-2026-70147 and CVE-2026-70153 in the Microsoft PostScript Printer Driver (each 9.8) without authentication. No exploitation is known for any of these vulnerabilities so far.

Outlook needs no click

Particularly critical are five critical Outlook vulnerabilities with CVSS 9.8: CVE-2026-70242, CVE-2026-70291, and CVE-2026-97016 are based on heap buffer overflows, CVE-2026-88156 on a stack-based overflow, and CVE-2026-97749 on a double free. The catch: a crafted email starts running its code as soon as Outlook displays it in the reading pane — the recipient doesn't need to open or click on the message. In Word, CVE-2026-70300 (9.8) only requires a WordPerfect document with a linked graphic; in PowerPoint, CVE-2026-88178 (9.8) only requires a crafted presentation to an Office Online service. Microsoft reports no attacks for any of these Office vulnerabilities so far — however, updates for Office LTSC for Mac 2021 and 2024 are still missing for CVE-2026-88178, CVE-2026-70291, and CVE-2026-88156.

Exchange, Active Directory, and SharePoint in the crosshairs

Server operators also need to be careful. CVE-2026-70571 in Exchange Server (CVSS 8.1) allows code execution without authentication — triggered by a crafted email that initiates an internal conversion process and within it a stack-based buffer overflow. Microsoft considers exploitation more likely; the same applies to CVE-2026-70229 in the Active Directory Domain Services (8.1), which allows code execution under certain network configurations. In SharePoint, Microsoft classifies CVE-2026-102866 (8.1) as critical: via a faulty signature check, an attacker with a valid user's proof token can modify this token and then impersonate that user to read or modify their content.

Cloud vulnerabilities have long been fixed

Microsoft already closed four cloud vulnerabilities on October 8, 2026 without customer action — customers of the services need neither an update nor a configuration change. The highest CVSS score of all Microsoft October vulnerabilities is achieved by CVE-2026-96207 in the Microsoft Partner Center with 10.0: via a faulty certificate check, an attacker can escalate their privileges without authentication. In Microsoft Bookings, CVE-2026-94510 (9.9) allows bypassing authorization; in Dataverse, CVE-2026-88131 (9.8), and in Azure App Service, CVE-2026-77900 (9.8), each allow code execution without authentication.

Final update for Windows 11 24H2 Home and Pro

A lifecycle notice relevant to many users: as WinFuture and Security Insider highlight, the October update is the final regular security update for Windows 11 24H2 in the Home and Pro editions as well as for Windows 10 Enterprise LTSB 2016. Anyone using these versions should plan the jump to Windows 11 25H2 — the Home and Pro editions of 25H2 will continue to receive updates until October 2027. The Enterprise and Education editions of Windows 11 23H2 will receive their final update on November 10, 2026. Windows Server 2022 moves into Extended Support with October and will continue to receive security updates there until October 2031. Home users with Windows 10 can still enroll in the ESU program until 10/12/2027.

What this means for you

If you run an Exchange server, a domain controller, or an NPS-based VPN access, urgency is required — Microsoft considers exploitation of CVE-2026-70571 and CVE-2026-70229 more likely than with other vulnerabilities. Deploy these updates first, followed by Outlook and DHCP. For home users: trigger Windows Update, restart, and verify that the update installed successfully. On Windows 11 24H2, 25H2, and 26H2, this is KB5127648 (build numbers 26100.9711, 26200.9711, 26300.9711); on 26H1 ARM64 devices, the separate KB5127646 (build 28000.3231); on Windows 10, KB5126657. Anyone still using Windows 11 24H2 Home or Pro should plan the move to 25H2 — otherwise, regular patches end in November.