October 2026 Microsoft Patch Tuesday - SANS ISC

Microsoft's October 2026 Patch Tuesday addresses a record 1,417 vulnerabilities, 76 of them rated critical, while 7 critical issues require no action from administrators. One flaw was publicly known before release and one is already being actively exploited. CVE-2026-96951, a Windows Shell security feature bypass, lets attackers sidestep the "Mark of the Web" protection, making it easier to run malicious code once a victim opens a file sent via email or instant messaging. CVE-2026-108398, a .NET framework security feature bypass that could let attackers evade application control, had public details before the patch but no observed exploitation. The update batch also covers 10 remote code execution bugs in the Windows DHCP Server (five critical), a high-complexity Exchange Server RCE tracked as CVE-2026-70571 triggered during email content conversion, and an unusually large set of Office fixes that administrators should prioritize deploying quickly.