Patch Tuesday - October 2026

What it is

Rapid7's write-up of Microsoft's October 2026 Patch Tuesday (1,413 vulnerabilities). The visible tables show where patching effort is best spent. Only one flaw is exploited in the wild, so Microsoft's "Exploitation More Likely" ratings are the main prioritisation signal.

How it works

• CVE-2026-96951 (Windows Shell, exploited): a Mark of the Web bypass. Windows shows no "protected your PC" prompt for a crafted file or attacker-controlled site. It also affected Outlook.com, which was patched in a build dated several weeks ago.
• CVE-2026-108398 (.NET Framework, publicly disclosed): an attacker with an existing foothold registers a malicious .NET assembly for loading by a protected process, bypassing WDAC (App Control for Business). Rapid7 presumes, without confirming, that the patch removes an attacker-controlled location from the assembly search list. Microsoft rates it "Exploitation Less Likely" (CVSS 8.8).
• Outlook preview-pane RCEs: CVE-2026-70242, CVE-2026-97749, CVE-2026-97016, CVE-2026-88156 and CVE-2026-70291 all trigger from the reading pane. They are fixed in the same patches. Rapid7 cites CVE-2023-23397 as precedent for state-backed use of this class.

Preconditions / Affected

• Server 2012 gets no patch for CVE-2026-96951. Server 2012 R2 does.
• Exchange: the visible ESU table lists CVE-2026-70279 (Exchange spoofing, CVSS 9.3) and CVE-2026-70571 (Exchange RCE, 8.1), both "More Likely". Four Exchange EoP flaws are rated "Less Likely".
• "More Likely" clusters in the visible tables (this view is truncated):
• Common Log File System: CVE-2026-70233, CVE-2026-85355, CVE-2026-85870
• Desktop Window Manager: CVE-2026-69880, CVE-2026-69926, CVE-2026-70255, CVE-2026-88093
• Windows Search: CVE-2026-70156, CVE-2026-83704, CVE-2026-88191, CVE-2026-96911
• BITS, including RCE CVE-2026-88159
• Direct Composition
• Ancillary Function Driver for WinSock
• WebDAV: CVE-2026-102217
• Win32k: CVE-2026-83732
• OpenSSH for Windows: CVE-2026-83769
• Active Directory Domain Services RCE: CVE-2026-70229
• CVSS 9.8 items worth triaging by exposure (all rated "Less Likely" or "Unlikely"):
• DHCP Server: CVE-2026-96320, CVE-2026-96934
• Windows DNS RCE: CVE-2026-83869, CVE-2026-96113
• NPS: CVE-2026-100222, CVE-2026-85806
• OpenSSH for Windows: CVE-2026-97816
• PostScript driver: CVE-2026-70147, CVE-2026-70153
• Microsoft XML: CVE-2026-83935
• PPP EAP-TLS: CVE-2026-84015
• Media Foundation: CVE-2026-83517, CVE-2026-85814
• RPC Runtime Library: CVE-2026-83910
• QUIC: CVE-2026-105016
• Failover Cluster Virtual Driver: CVE-2026-96864
• PowerShell: CVE-2026-83578
• Windows Search EoP: CVE-2026-105010

What to do

• Patch Windows endpoints for CVE-2026-96951 first, since it is the only exploited flaw. Plan a migration for any Server 2012, which gets no fix.
• Patch Outlook clients for all five preview-pane RCEs.
• Put the "More Likely" local EoP clusters (CLFS, DWM, Windows Search, BITS) ahead of higher-CVSS flaws rated "Less Likely".
• Patch Exchange for CVE-2026-70279 and CVE-2026-70571.
• Edge: the Security Update Guide listed zero Edge CVEs for the first 13 days of October, with release notes saying "CVE's will be added as soon as available". Track Edge by Chromium-based version rather than CVE.
• End-of-life dates:
• Windows Server 2012 and 2012 R2: ESU Year 3 ends October 14, 2026.
• Office 2021, including LTSC: October 14, with no ESU.
• Windows 11 24H2 Home and Pro: end of servicing.
• Windows Server 2022: moves to extended support.
• Exchange 2016 and 2019: October 15, with no ESU. MSRC will stop listing them in future CVEs, which does not mean they are not vulnerable.

Caveats

The page text is truncated at about 60,000 of 265,000 characters. The tables above stop partway through the ESU Windows list, so the remaining CVEs, including the exploited CVE-2026-96951 entry and the Outlook rows, are not seen. Exploitability ratings are Microsoft's, not Rapid7's. The explanation of the WDAC patch is Rapid7's presumption.