Zero-Days Lurk in Microsoft's Overgrown October Patch Tuesday

Microsoft's October 2026 Patch Tuesday set a new record, fixing 1,413 vulnerabilities across its product line, including 80 rated critical and two zero-day flaws. One of the zero-days, CVE-2026-96951 (CVSS 8.8) in Windows Shell, is already being exploited in the wild; it lets attackers bypass the Mark of the Web tagging system, defeating downstream protections like SmartScreen, Office Protected View, macro blocking, and Smart App Control without triggering any warning to the user. The second zero-day, CVE-2026-108398 (CVSS 8.8) in .NET Framework, requires local low-privilege access and is considered less likely to be exploited, though researchers warn it's a potent post-compromise tool for bypassing Windows Defender Application Control. Beyond Windows, which accounted for the bulk of the fixes, analysts flagged a critical zero-click Outlook Reading Pane RCE (CVE-2026-70242, CVSS 9.8), a SharePoint privilege-escalation bug (CVE-2026-102866), and a Microsoft QUIC buffer overflow (CVE-2026-105016, CVSS 9.8) as top priorities for immediate patching.