Microsoft’s October 2026 Patch Tuesday addresses 1407 CVEs (CVE-2026-96951)
- 69Critical
- 1337Important
- 0Moderate
- 1Low
Microsoft addresses 1407 CVEs in the tenth Patch Tuesday of 2026, marking the second consecutive month to reset the bar as the largest Patch Tuesday release. This month’s updates include patches for two zero days, including one that was exploited in the wild.
Microsoft patched 1,407 CVEs in its October 2026 Patch Tuesday release, with 69 rated critical, 1,337 rated as important, and one rated as low.
This month’s update includes patches for 301 products and components. The following table lists the products with the most CVEs patched this month. A full list of patched products is available in the appendix.
| Rank | Product | CVE Count |
|---|---|---|
| 1 | Microsoft Office Excel | 69 |
| 2 | Role: DNS Server | 52 |
| 3 | Windows Kernel | 46 |
| 4 | Windows Installer | 38 |
| 5 | Windows Win32 Kernel Subsystem | 36 |
| 6 | Microsoft Office SharePoint | 34 |
| 7 | Microsoft Windows Search Component | 29 |
| 8 | Windows NTFS | 26 |
| 9 | .NET | 25 |
| 10 (Tie) | Microsoft Office Word | 22 |
| 10 (Tie) | SQL Server | 22 |
| 10 (Tie) | Windows Error Reporting | 22 |
Elevation of Privilege (EoP) vulnerabilities accounted for 47.9% of the vulnerabilities patched this month, followed by remote code execution (RCE) vulnerabilities at 22.3%.
CVE-2026-96951 | Windows Shell security feature bypass vulnerability
CVE-2026-96951 is a security feature bypass vulnerability affecting Windows Shell. It received a CVSSv3 score of 8.8 and was rated as important. According to Microsoft, this vulnerability was exploited in the wild as a zero-day.
An attacker could exploit this vulnerability using social engineering tactics, via email or messages, to convince their target to open a malicious file. Successful exploitation would bypass the Mark of the Web (MOTW) security feature.
This is the third flaw in Windows Shell that was exploited in the wild in 2026: CVE-2026-21510 was patched in February 2026’s Patch Tuesday while CVE-2026-32202 was patched in April 2026’s Patch Tuesday.
CVE-2026-108398 |.NET Framework security feature bypass vulnerability
CVE-2026-108398 is a security feature bypass vulnerability affecting.NET Framework. It received a CVSSv3 score of 8.8 and is rated as important. It was publicly disclosed prior to a patch being available.
An attacker could exploit this vulnerability by registering a malicious.NET assembly on a vulnerable system to be loaded by a protected process. Successful exploitation would allow the attacker to bypass Windows Defender Application Control (WDAC).
CVE-2026-70229 | Windows Active Directory Domain Services remote code execution vulnerability
CVE-2026-70229 is an RCE vulnerability affecting Windows Active Directory Domain Services (AD DS). It received a CVSSv3 score of 8.1 and is rated as critical. Microsoft assesses this vulnerability as “Exploitation More Likely” according to Microsoft’s Exploitability Index.
An attacker could exploit this vulnerability by sending a crafted packet to the vulnerable AD DS service. Successful exploitation could grant an attacker code execution on the vulnerable system.
CVE-2026-70279 | Microsoft Exchange Server spoofing vulnerability
CVE-2026-70279 is a spoofing vulnerability affecting Microsoft Exchange Server. It received a CVSSv3 score of 9.3 and is rated as important. It was assessed as “Exploitation More Likely.” An attacker could exploit this vulnerability by convincing a target through social engineering to click on a malicious link. Successful exploitation against a target with administrative privileges would allow an attacker to access or modify organizational data.
CVE-2026-70571 | Microsoft Exchange Server remote code execution vulnerability
CVE-2026-70571 is a remote code execution vulnerability affecting Microsoft Exchange Server. It received a CVSSv3 score of 8.1 and is rated as critical. It was assessed as “Exploitation More Likely.”
An attacker could exploit this vulnerability by sending a malicious email to a vulnerable Microsoft Exchange server that would cause it to process the email using internal content-conversion. Successful exploitation would allow an attacker the ability to execute code on the Exchange server.
Additional notable CVEs
The following CVEs also merit attention based on severity, exploitability, or CVSSv3 score:
| CVE | Product | Impact | CVSSv3 | Exploitability | Notes |
|---|---|---|---|---|---|
| CVE-2026-100214 | Dynamics Business Central | Remote Code Execution | 8.8 | Exploitation More Likely | Important |
| CVE-2026-102217 | WebDAV | Elevation of Privilege | 8.8 | Exploitation More Likely | Important |
| CVE-2026-69918 | Windows Core Messaging | Elevation of Privilege | 8.8 | Exploitation More Likely | Important |
| CVE-2026-88159 | Windows Background Intelligent Transfer Service (BITS) | Remote Code Execution | 8.8 | Exploitation More Likely | Important |
| CVE-2026-96940 | Microsoft Exchange Server | Elevation of Privilege | 8.8 | Exploitation More Likely | Important |
| CVE-2026-69673 | Windows Update | Elevation of Privilege | 7.8 | Exploitation More Likely | Important |
| CVE-2026-69718 | Windows Update | Elevation of Privilege | 7.8 | Exploitation More Likely | Important |
| CVE-2026-69733 | Windows Update | Elevation of Privilege | 7.8 | Exploitation More Likely | Important |
| CVE-2026-69783 | Windows Update | Elevation of Privilege | 7.8 | Exploitation More Likely | Important |
| CVE-2026-69880 | Desktop Window Manager | Elevation of Privilege | 7.8 | Exploitation More Likely | Important |
| CVE-2026-69882 | Windows Update | Elevation of Privilege | 7.8 | Exploitation More Likely | Important |
| CVE-2026-69923 | Windows AI | Elevation of Privilege | 7.8 | Exploitation More Likely | Important |
| CVE-2026-69926 | Desktop Window Manager | Elevation of Privilege | 7.8 | Exploitation More Likely | Important |
| CVE-2026-70054 | Windows NetBIOS | Elevation of Privilege | 7.8 | Exploitation More Likely | Important |
Windows Server 2012 End of Support
On October 13, the final year of Extended Security Updates (ESU) for Windows Server 2012 and Windows Server 2012 R2 ended. Microsoft will no longer release security updates for either version. To identify unsupported versions of Windows Server 2012, customers can use plugin ID 192813. To check the ESU status of Windows Server 2012 and 2012 R2 hosts, customers can use plugin ID 182965.
Extended support for Windows 10 Enterprise 2016 Long-Term Servicing Branch (LTSB) and Windows 10 IoT Enterprise LTSB 2016 also ended on October 13. To identify Windows 10 Enterprise 2016 LTSB, customers can use plugin ID 192817.
Windows Server 2022 End of Mainstream Support
October 13, 2026 marks the end of mainstream support for Windows Server 2022. This month’s security update is the last one issued under mainstream support. The product now enters extended support, where it will continue receiving monthly security updates at no additional cost through October 14, 2031. Organizations still running Windows Server 2022 can begin evaluating an upgrade path to Windows Server 2025, the current LTSC release, which carries mainstream support through November 2029 and extended support through November 2034.
Additional Microsoft Products End of Support
As of October 13, several Microsoft products have reached end of support. Since these products will no longer receive security updates, we recommend upgrading to supported versions as soon as possible.
- Office 2021
- Office LTSC 2021
- Office LTSC 2021 for Mac
- Skype for Business LTSC 2021
- Windows 11 Home and Pro Version 24H2
Tenable solutions
A list of all the plugins released for Microsoft’s October 2026 Patch Tuesday update can be found here. As always, we recommend patching systems as soon as possible and regularly scanning your environment to identify those systems yet to be patched.
For more specific guidance on best practices for vulnerability assessments, refer to our blog post on How to Perform Efficient Vulnerability Assessments with Tenable.
Product Appendix
- .NET
- .NET Framework
- .NET and Visual Studio
- ASP.NET Core
- Active Directory Certificate Services (AD CS)
- Active Directory Domain Services
- Active Directory Federation Services (AD FS)
- Azure Active Directory
- Azure Arc
- Azure CycleCloud
- Azure DevOps
- Azure HDInsight
- Azure Key Vault
- Azure Storage Library
- Connected Devices Platform Service (Cdpsvc)
- Desktop Window Manager
- Dynamics Business Central
- Function Discovery Service (fdwsd.dll)
- Graphic Fonts
- HID Parser Library
- HID class driver
- Internet Explorer
- Linux Kernel
- Microsoft Account
- Microsoft Azure Attestation service and Device Health Attestation Service
- Microsoft Bluetooth Driver
- Microsoft COM for Windows
- Microsoft Configuration Manager
- Microsoft Defender
- Microsoft Defender for Endpoint
- Microsoft Digest Authentication
- Microsoft Exchange Server
- Microsoft Failover Cluster Virtual Driver
- Microsoft Graphics Component
- Microsoft Input Method Editor (IME)
- Microsoft Internet Messaging API
- Microsoft Local Security Authority Server (lsasrv)
- Microsoft MPEG-2 Video Extension
- Microsoft Office
- Microsoft Office Access
- Microsoft Office Click-To-Run
- Microsoft Office Excel
- Microsoft Office OneNote
- Microsoft Office Outlook
- Microsoft Office PowerPoint
- Microsoft Office SharePoint
- Microsoft Office Visio
- Microsoft Office Word
- Microsoft PostScript Printer Driver
- Microsoft Power Apps
- Microsoft PowerShell
- Microsoft PowerToys
- Microsoft QUIC
- Microsoft Scripting Engine
- Microsoft Streaming Service
- Microsoft Trace Data Helper
- Microsoft Windows Codecs Library
- Microsoft Windows Media Foundation
- Microsoft Windows PDF
- Microsoft Windows Search Component
- Microsoft XML
- Network Device Enrollment Service (NDES)
- Network Policy Server (NPS)
- OpenSSH for Windows
- Python
- Quality Windows Audio/Video Experience (QWAVE) service
- RPC Endpoint Mapper Service
- RPC Runtime
- Reliable Multicast Transport Driver (RMCAST)
- Remote Access Point-to-Point Protocol (PPP) EAP-TLS
- Remote Desktop Client
- Remote Desktop Display Driver
- Remote Desktop Gateway Service
- Role: DNS Server
- SQL Server
- SQLite
- Servicing Stack Updates
- Skype for Business and Microsoft Lync
- Software Protection Platform (SPP)
- SysInternals
- Virtual Hard Disk (VHD) Miniport Driver
- Visual Studio Code
- Visual Studio Tools for Applications and SQL Server Management Studio
- WebDAV
- Windows AI
- Windows ALPC
- Windows Advanced Rasterization Platform
- Windows Aggregated Data Platform Service
- Windows Ancillary Function Driver for WinSock
- Windows AppX Deployment Extensions
- Windows AppX Deployment Service
- Windows Application Compatibility Cache
- Windows Assigned Access
- Windows Audio Service
- Windows Autopilot
- Windows Background Intelligent Transfer Service (BITS)
- Windows Backup Engine
- Windows Bind Filter Driver
- Windows Biometric Service
- Windows BitLocker
- Windows Bluetooth A2DP driver
- Windows Bluetooth Port Driver
- Windows Bluetooth Service
- Windows Broadcast DVR User Service
- Windows CCFFilter Driver
- Windows CD-ROM Driver
- Windows COM+ Event System Service
- Windows Camera Frame Server Monitor
- Windows Cash Drawer Protocol Provider
- Windows Certificates
- Windows Client License Service
- Windows Client Side Caching driver (csc.sys)
- Windows Client for NFS
- Windows Client-Side Caching (CSC) Service
- Windows Clipboard Server
- Windows Clipboard User Service
- Windows Cloud Files Mini Filter Driver
- Windows Common Log File System Driver
- Windows Composite Image File System
- Windows Connected Devices Platform Service
- Windows Connected User Experiences and Telemetry
- Windows Console Driver
- Windows Container Isolation FS Filter Driver
- Windows Container Isolation FS Filter Driver (unionfs.sys)
- Windows Core Messaging
- Windows Credential Guard
- Windows Credential Manager
- Windows Credential Providers
- Windows Cryptographic Services
- Windows DCOM Server
- Windows DHCP Client
- Windows DHCP Server
- Windows DNS
- Windows DWM Core Library
- Windows Defender Firewall Service
- Windows Deployment Services
- Windows Device Association Service
- Windows Device Install Service
- Windows Diagnostic Policy Service
- Windows Direct Composition
- Windows Distributed File System (DFS)
- Windows EAPHost Service
- Windows Embedded Mode Service
- Windows Encrypting File System (EFS)
- Windows Enterprise App Management
- Windows Error Reporting
- Windows Event Logging Service
- Windows Event Tracing
- Windows Event Viewer
- Windows Failover Cluster
- Windows Fast FAT Driver
- Windows Fax and Scan Service
- Windows GDI
- Windows GDI+
- Windows Geotag Broker
- Windows Graphics Kernel
- Windows Group Policy
- Windows HTTP.sys
- Windows Health and Optimized Experiences Service
- Windows Hello
- Windows Host Guardian Service
- Windows Hyper-V
- Windows IKE Extension
- Windows IP Over USB Service
- Windows Image Acquisition
- Windows Imaging Component
- Windows Input System
- Windows Installer
- Windows Internal System User Profile
- Windows Internet (wininet.dll)
- Windows Internet Connection Sharing (ICS)
- Windows Internet Information Services
- Windows Internet Key Exchange (IKE) Protocol
- Windows Kerberos
- Windows Kernel
- Windows Kernel Mode Driver
- Windows Kernel-Mode Drivers
- Windows Key Distribution Center
- Windows Key Storage Provider
- Windows Libarchive
- Windows Local Security Authority (LSA)
- Windows Local Security Authority Subsystem Service (LSASS)
- Windows MIDI Service Module
- Windows Management Instrumentation
- Windows Management Services
- Windows Media
- Windows Media Player
- Windows Media Video Decoder
- Windows Message Queuing
- Windows Message Queuing Queue Manager
- Windows Mobile Broadband
- Windows Mobile Device Management
- Windows Modern Device Management (MDM)
- Windows NDIS
- Windows NTFS
- Windows NTLM
- Windows NetBIOS
- Windows Netlogon
- Windows Network File System
- Windows Network List Service
- Windows Network Load Balancing
- Windows Notification
- Windows Now Playing Session Manager
- Windows OLE
- Windows OLE DB
- Windows Overlay Filter
- Windows PCI Bus Driver
- Windows Paint
- Windows Partition Management Driver
- Windows Perception Simulation Service
- Windows Performance Monitor
- Windows Phone Service
- Windows Portable Device Enumerator Service
- Windows Portable Device File System Driver
- Windows Portable Device MTP Driver
- Windows PowerShell
- Windows Print Spooler Components
- Windows Program Compatibility Assistant Service
- Windows Projected File System
- Windows Push Notifications
- Windows Quality of Service (QoS) Packet Scheduler
- Windows RNDIS
- Windows Raw Image Extension
- Windows Registry
- Windows Remote Access Connection Manager
- Windows Remote Access Service Infrastructure
- Windows Remote Desktop
- Windows Remote Desktop Protocol
- Windows Remote Desktop Services
- Windows Remote POS Driver
- Windows Resilient File System (ReFS)
- Windows Resilient File System (ReFS) Deduplication Service
- Windows Resource Management (MRM)
- Windows Resume
- Windows Rich Text Edit Control
- Windows Routing and Remote Access Service (RRAS)
- Windows SMB Client
- Windows SMB Server
- Windows Schannel
- Windows Secure Boot
- Windows Secure Kernel Mode
- Windows Secure Socket Tunneling Protocol (SSTP)
- Windows Security Account Manager
- Windows Security App
- Windows Security Center
- Windows Security Support Provider Interface
- Windows Sensor Data Service
- Windows Server Update Service
- Windows Server for NFS
- Windows Setup Files Cleanup
- Windows Setup and Deployment
- Windows Shell
- Windows Smart Card
- Windows SmartScreen
- Windows Spaceport.sys
- Windows StateRepository API
- Windows Storage
- Windows Storage Port Driver
- Windows Storage Spaces Controller
- Windows Storage VSP Driver
- Windows Storport Miniport Driver
- Windows Subsystem for Linux
- Windows Sysmain Service
- Windows System Information Console
- Windows TCP/IP
- Windows Telephony Server
- Windows Text Services Framework
- Windows Text Shaping
- Windows UEFI
- Windows UI Immersive Server
- Windows USB Driver
- Windows USB Print Driver
- Windows USB Video Driver
- Windows Universal Disk Format File System Driver (UDFS)
- Windows Universal Plug and Play (UPnP) Device Host
- Windows Update
- Windows Update Delivery Optimization
- Windows Update Orchestrator Service
- Windows Update Service
- Windows Update Stack
- Windows User Profile Service
- Windows VHD miniport driver
- Windows VMSwitch
- Windows Virtual Input
- Windows Virtualization-Based Security (VBS) Enclave
- Windows Volume Manager Extension Driver
- Windows WLAN Service
- Windows WalletService
- Windows Web Account Manager
- Windows Wi-Fi Driver
- Windows Win32 Kernel Subsystem
- Windows Win32K
- Windows Win32K - GRFX
- Windows Win32K - ICOMP
- Windows Wired AutoConfig Service
- Windows Work Folders
- Windows Workstation Service
- Windows exFAT File System
- Windows iSCSI
- Windows kernel32.dll
- Winlogon
Get more information
Learn more
Learn more
Related articles
- Exposure Management
- Vulnerability Management
Tenable One
Request a demo
The world’s leading AI-powered exposure management platform.
Thank You
Thank you for your interest in Tenable One.
A representative will be in touch soon.
Form ID: 7469
Form Name: one-eval
Form Class: c-form form-panel__global-form c-form--mkto js-mkto-no-css js-form-hanging-label c-form--hide-comments
Form Wrapper ID: one-eval-form-wrapper
Confirmation Class: one-eval-confirmform-modal
Simulate Success