Microsoft’s October 2026 Patch Tuesday addresses 1407 CVEs (CVE-2026-96951)

69Critical1337Important0Moderate1LowMicrosoft addresses 1407 CVEs in the tenth Patch Tuesday of 2026, marking the second consecutive month to reset the bar as the largest Patch Tuesday release. This month’s updates include patches for two zero days, including one that was exploited in the wild.Microsoft patched 1,407 CVEs in its October 2026 Patch Tuesday release, with 69 rated critical, 1,337 rated as important, and one rated as low.This month’s update includes patches for 301 products and components. The following table lists the products with the most CVEs patched this month. A full list of patched products is available in the appendix.RankProductCVE Count1Microsoft Office Excel692Role: DNS Server523Windows Kernel464Windows Installer385Windows Win32 Kernel Subsystem366Microsoft Office SharePoint347Microsoft Windows Search Component298Windows NTFS269.NET2510 (Tie)Microsoft Office Word2210 (Tie)SQL Server2210 (Tie)Windows Error Reporting22Elevation of Privilege (EoP) vulnerabilities accounted for 47.9% of the vulnerabilities patched this month, followed by remote code execution (RCE) vulnerabilities at 22.3%.ImportantCVE-2026-96951 | Windows Shell security feature bypass vulnerabilityCVE-2026-96951 is a security feature bypass vulnerability affecting Windows Shell. It received a CVSSv3 score of 8.8 and was rated as important. According to Microsoft, this vulnerability was exploited in the wild as a zero-day.An attacker could exploit this vulnerability using social engineering tactics, via email or messages, to convince their target to open a malicious file. Successful exploitation would bypass the Mark of the Web (MOTW) security feature.This is the third flaw in Windows Shell that was exploited in the wild in 2026: CVE-2026-21510 was patched in February 2026’s Patch Tuesday while CVE-2026-32202 was patched in April 2026’s Patch Tuesday.ImportantCVE-2026-108398 |.NET Framework security feature bypass vulnerabilityCVE-2026-108398 is a security feature bypass vulnerability affecting.NET Framework. It received a CVSSv3 score of 8.8 and is rated as important. It was publicly disclosed prior to a patch being available.An attacker could exploit this vulnerability by registering a malicious.NET assembly on a vulnerable system to be loaded by a protected process. Successful exploitation would allow the attacker to bypass Windows Defender Application Control (WDAC).CriticalCVE-2026-70229 | Windows Active Directory Domain Services remote code execution vulnerabilityCVE-2026-70229 is an RCE vulnerability affecting Windows Active Directory Domain Services (AD DS). It received a CVSSv3 score of 8.1 and is rated as critical. Microsoft assesses this vulnerability as “Exploitation More Likely” according to Microsoft’s Exploitability Index.An attacker could exploit this vulnerability by sending a crafted packet to the vulnerable AD DS service. Successful exploitation could grant an attacker code execution on the vulnerable system.ImportantCVE-2026-70279 | Microsoft Exchange Server spoofing vulnerabilityCVE-2026-70279 is a spoofing vulnerability affecting Microsoft Exchange Server. It received a CVSSv3 score of 9.3 and is rated as important. It was assessed as “Exploitation More Likely.” An attacker could exploit this vulnerability by convincing a target through social engineering to click on a malicious link. Successful exploitation against a target with administrative privileges would allow an attacker to access or modify organizational data.CriticalCVE-2026-70571 | Microsoft Exchange Server remote code execution vulnerabilityCVE-2026-70571 is a remote code execution vulnerability affecting Microsoft Exchange Server. It received a CVSSv3 score of 8.1 and is rated as critical. It was assessed as “Exploitation More Likely.”An attacker could exploit this vulnerability by sending a malicious email to a vulnerable Microsoft Exchange server that would cause it to process the email using internal content-conversion. Successful exploitation would allow an attacker the ability to execute code on the Exchange server.Additional notable CVEsThe following CVEs also merit attention based on severity, exploitability, or CVSSv3 score:CVEProductImpactCVSSv3ExploitabilityNotesCVE-2026-100214Dynamics Business CentralRemote Code Execution8.8Exploitation More LikelyImportantCVE-2026-102217WebDAVElevation of Privilege8.8Exploitation More LikelyImportantCVE-2026-69918Windows Core MessagingElevation of Privilege8.8Exploitation More LikelyImportantCVE-2026-88159Windows Background Intelligent Transfer Service (BITS)Remote Code Execution8.8Exploitation More LikelyImportantCVE-2026-96940Microsoft Exchange ServerElevation of Privilege8.8Exploitation More LikelyImportantCVE-2026-69673Windows UpdateElevation of Privilege7.8Exploitation More LikelyImportantCVE-2026-69718Windows UpdateElevation of Privilege7.8Exploitation More LikelyImportantCVE-2026-69733Windows UpdateElevation of Privilege7.8Exploitation More LikelyImportantCVE-2026-69783Windows UpdateElevation of Privilege7.8Exploitation More LikelyImportantCVE-2026-69880Desktop Window ManagerElevation of Privilege7.8Exploitation More LikelyImportantCVE-2026-69882Windows UpdateElevation of Privilege7.8Exploitation More LikelyImportantCVE-2026-69923Windows AIElevation of Privilege7.8Exploitation More LikelyImportantCVE-2026-69926Desktop Window ManagerElevation of Privilege7.8Exploitation More LikelyImportantCVE-2026-70054Windows NetBIOSElevation of Privilege7.8Exploitation More LikelyImportantWindows Server 2012 End of SupportOn October 13, the final year of Extended Security Updates (ESU) for Windows Server 2012 and Windows Server 2012 R2 ended. Microsoft will no longer release security updates for either version. To identify unsupported versions of Windows Server 2012, customers can use plugin ID 192813. To check the ESU status of Windows Server 2012 and 2012 R2 hosts, customers can use plugin ID 182965.Extended support for Windows 10 Enterprise 2016 Long-Term Servicing Branch (LTSB) and Windows 10 IoT Enterprise LTSB 2016 also ended on October 13. To identify Windows 10 Enterprise 2016 LTSB, customers can use plugin ID 192817.Windows Server 2022 End of Mainstream SupportOctober 13, 2026 marks the end of mainstream support for Windows Server 2022. This month’s security update is the last one issued under mainstream support. The product now enters extended support, where it will continue receiving monthly security updates at no additional cost through October 14, 2031. Organizations still running Windows Server 2022 can begin evaluating an upgrade path to Windows Server 2025, the current LTSC release, which carries mainstream support through November 2029 and extended support through November 2034.Additional Microsoft Products End of SupportAs of October 13, several Microsoft products have reached end of support. Since these products will no longer receive security updates, we recommend upgrading to supported versions as soon as possible.Office 2021Office LTSC 2021Office LTSC 2021 for MacSkype for Business LTSC 2021Windows 11 Home and Pro Version 24H2Tenable solutionsA list of all the plugins released for Microsoft’s October 2026 Patch Tuesday update can be found here. As always, we recommend patching systems as soon as possible and regularly scanning your environment to identify those systems yet to be patched.For more specific guidance on best practices for vulnerability assessments, refer to our blog post on How to Perform Efficient Vulnerability Assessments with Tenable.Product Appendix.NET.NET Framework.NET and Visual StudioASP.NET CoreActive Directory Certificate Services (AD CS)Active Directory Domain ServicesActive Directory Federation Services (AD FS)Azure Active DirectoryAzure ArcAzure CycleCloudAzure DevOpsAzure HDInsightAzure Key VaultAzure Storage LibraryConnected Devices Platform Service (Cdpsvc)Desktop Window ManagerDynamics Business CentralFunction Discovery Service (fdwsd.dll)Graphic FontsHID Parser LibraryHID class driverInternet ExplorerLinux KernelMicrosoft AccountMicrosoft Azure Attestation service and Device Health Attestation ServiceMicrosoft Bluetooth DriverMicrosoft COM for WindowsMicrosoft Configuration ManagerMicrosoft DefenderMicrosoft Defender for EndpointMicrosoft Digest AuthenticationMicrosoft Exchange ServerMicrosoft Failover Cluster Virtual DriverMicrosoft Graphics ComponentMicrosoft Input Method Editor (IME)Microsoft Internet Messaging APIMicrosoft Local Security Authority Server (lsasrv)Microsoft MPEG-2 Video ExtensionMicrosoft OfficeMicrosoft Office AccessMicrosoft Office Click-To-RunMicrosoft Office ExcelMicrosoft Office OneNoteMicrosoft Office OutlookMicrosoft Office PowerPointMicrosoft Office SharePointMicrosoft Office VisioMicrosoft Office WordMicrosoft PostScript Printer DriverMicrosoft Power AppsMicrosoft PowerShellMicrosoft PowerToysMicrosoft QUICMicrosoft Scripting EngineMicrosoft Streaming ServiceMicrosoft Trace Data HelperMicrosoft Windows Codecs LibraryMicrosoft Windows Media FoundationMicrosoft Windows PDFMicrosoft Windows Search ComponentMicrosoft XMLNetwork Device Enrollment Service (NDES)Network Policy Server (NPS)OpenSSH for WindowsPythonQuality Windows Audio/Video Experience (QWAVE) serviceRPC Endpoint Mapper ServiceRPC RuntimeReliable Multicast Transport Driver (RMCAST)Remote Access Point-to-Point Protocol (PPP) EAP-TLSRemote Desktop ClientRemote Desktop Display DriverRemote Desktop Gateway ServiceRole: DNS ServerSQL ServerSQLiteServicing Stack UpdatesSkype for Business and Microsoft LyncSoftware Protection Platform (SPP)SysInternalsVirtual Hard Disk (VHD) Miniport DriverVisual Studio CodeVisual Studio Tools for Applications and SQL Server Management StudioWebDAVWindows AIWindows ALPCWindows Advanced Rasterization PlatformWindows Aggregated Data Platform ServiceWindows Ancillary Function Driver for WinSockWindows AppX Deployment ExtensionsWindows AppX Deployment ServiceWindows Application Compatibility CacheWindows Assigned AccessWindows Audio ServiceWindows AutopilotWindows Background Intelligent Transfer Service (BITS)Windows Backup EngineWindows Bind Filter DriverWindows Biometric ServiceWindows BitLockerWindows Bluetooth A2DP driverWindows Bluetooth Port DriverWindows Bluetooth ServiceWindows Broadcast DVR User ServiceWindows CCFFilter DriverWindows CD-ROM DriverWindows COM+ Event System ServiceWindows Camera Frame Server MonitorWindows Cash Drawer Protocol ProviderWindows CertificatesWindows Client License ServiceWindows Client Side Caching driver (csc.sys)Windows Client for NFSWindows Client-Side Caching (CSC) ServiceWindows Clipboard ServerWindows Clipboard User ServiceWindows Cloud Files Mini Filter DriverWindows Common Log File System DriverWindows Composite Image File SystemWindows Connected Devices Platform ServiceWindows Connected User Experiences and TelemetryWindows Console DriverWindows Container Isolation FS Filter DriverWindows Container Isolation FS Filter Driver (unionfs.sys)Windows Core MessagingWindows Credential GuardWindows Credential ManagerWindows Credential ProvidersWindows Cryptographic ServicesWindows DCOM ServerWindows DHCP ClientWindows DHCP ServerWindows DNSWindows DWM Core LibraryWindows Defender Firewall ServiceWindows Deployment ServicesWindows Device Association ServiceWindows Device Install ServiceWindows Diagnostic Policy ServiceWindows Direct CompositionWindows Distributed File System (DFS)Windows EAPHost ServiceWindows Embedded Mode ServiceWindows Encrypting File System (EFS)Windows Enterprise App ManagementWindows Error ReportingWindows Event Logging ServiceWindows Event TracingWindows Event ViewerWindows Failover ClusterWindows Fast FAT DriverWindows Fax and Scan ServiceWindows GDIWindows GDI+Windows Geotag BrokerWindows Graphics KernelWindows Group PolicyWindows HTTP.sysWindows Health and Optimized Experiences ServiceWindows HelloWindows Host Guardian ServiceWindows Hyper-VWindows IKE ExtensionWindows IP Over USB ServiceWindows Image AcquisitionWindows Imaging ComponentWindows Input SystemWindows InstallerWindows Internal System User ProfileWindows Internet (wininet.dll)Windows Internet Connection Sharing (ICS)Windows Internet Information ServicesWindows Internet Key Exchange (IKE) ProtocolWindows KerberosWindows KernelWindows Kernel Mode DriverWindows Kernel-Mode DriversWindows Key Distribution CenterWindows Key Storage ProviderWindows LibarchiveWindows Local Security Authority (LSA)Windows Local Security Authority Subsystem Service (LSASS)Windows MIDI Service ModuleWindows Management InstrumentationWindows Management ServicesWindows MediaWindows Media PlayerWindows Media Video DecoderWindows Message QueuingWindows Message Queuing Queue ManagerWindows Mobile BroadbandWindows Mobile Device ManagementWindows Modern Device Management (MDM)Windows NDISWindows NTFSWindows NTLMWindows NetBIOSWindows NetlogonWindows Network File SystemWindows Network List ServiceWindows Network Load BalancingWindows NotificationWindows Now Playing Session ManagerWindows OLEWindows OLE DBWindows Overlay FilterWindows PCI Bus DriverWindows PaintWindows Partition Management DriverWindows Perception Simulation ServiceWindows Performance MonitorWindows Phone ServiceWindows Portable Device Enumerator ServiceWindows Portable Device File System DriverWindows Portable Device MTP DriverWindows PowerShellWindows Print Spooler ComponentsWindows Program Compatibility Assistant ServiceWindows Projected File SystemWindows Push NotificationsWindows Quality of Service (QoS) Packet SchedulerWindows RNDISWindows Raw Image ExtensionWindows RegistryWindows Remote Access Connection ManagerWindows Remote Access Service InfrastructureWindows Remote DesktopWindows Remote Desktop ProtocolWindows Remote Desktop ServicesWindows Remote POS DriverWindows Resilient File System (ReFS)Windows Resilient File System (ReFS) Deduplication ServiceWindows Resource Management (MRM)Windows ResumeWindows Rich Text Edit ControlWindows Routing and Remote Access Service (RRAS)Windows SMB ClientWindows SMB ServerWindows SchannelWindows Secure BootWindows Secure Kernel ModeWindows Secure Socket Tunneling Protocol (SSTP)Windows Security Account ManagerWindows Security AppWindows Security CenterWindows Security Support Provider InterfaceWindows Sensor Data ServiceWindows Server Update ServiceWindows Server for NFSWindows Setup Files CleanupWindows Setup and DeploymentWindows ShellWindows Smart CardWindows SmartScreenWindows Spaceport.sysWindows StateRepository APIWindows StorageWindows Storage Port DriverWindows Storage Spaces ControllerWindows Storage VSP DriverWindows Storport Miniport DriverWindows Subsystem for LinuxWindows Sysmain ServiceWindows System Information ConsoleWindows TCP/IPWindows Telephony ServerWindows Text Services FrameworkWindows Text ShapingWindows UEFIWindows UI Immersive ServerWindows USB DriverWindows USB Print DriverWindows USB Video DriverWindows Universal Disk Format File System Driver (UDFS)Windows Universal Plug and Play (UPnP) Device HostWindows UpdateWindows Update Delivery OptimizationWindows Update Orchestrator ServiceWindows Update ServiceWindows Update StackWindows User Profile ServiceWindows VHD miniport driverWindows VMSwitchWindows Virtual InputWindows Virtualization-Based Security (VBS) EnclaveWindows Volume Manager Extension DriverWindows WLAN ServiceWindows WalletServiceWindows Web Account ManagerWindows Wi-Fi DriverWindows Win32 Kernel SubsystemWindows Win32KWindows Win32K - GRFXWindows Win32K - ICOMPWindows Wired AutoConfig ServiceWindows Work FoldersWindows Workstation ServiceWindows exFAT File SystemWindows iSCSIWindows kernel32.dllWinlogonGet more informationMicrosoft’s October 2026 Security UpdatesTenable plugins for Microsoft October 2026 Patch Tuesday Security Updates