Skip to content

Back to the catalog

Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities
blog.talosintelligence.comadvisory

Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities

Talos summarises Microsoft's October 2026 Patch Tuesday, which covers 1415 vulnerabilities, 85 of them critical (67 RCE). One bug is exploited in the wild: CVE-2026-96951, a Windows Shell security feature bypass. The post groups the CVEs by Microsoft's exploitability rating (more likely, less likely, unlikely) with CVSS and CWE for each, covering Windows, Office, Exchange, Hyper-V, DHCP, QUIC, Outlook and Azure. It also lists the Snort 2 and Snort 3 rule ID ranges that detect exploitation attempts.

TL;DR Talos triage of Microsoft's October 2026 Patch Tuesday (1415 CVEs, one exploited: CVE-2026-96951) with Snort 2/3 rule coverage.
Open original ↗
Document

What it is

Talos's rundown of Microsoft's October 2026 Patch Tuesday. The page names specific CVEs by Microsoft's exploitability rating, so you can decide what to patch first without reading all 1415 entries.

What the page says about the zero-day

CVE-2026-96951 is the only bug Microsoft marks as exploited in the wild. It affects Windows Shell, is rated CVSS 8.8, and is classed as a security feature bypass. Its CWE is command injection (improper neutralization of special elements). The page gives no exploit details beyond that.

Preconditions / Affected

Microsoft rates these "exploitation more likely" among the critical bugs:

  • CVE-2026-70229: Active Directory Domain Services RCE, incorrect authorization, CVSS 8.1.
  • CVE-2026-70571: Exchange Server RCE, stack-based buffer overflow, CVSS 8.1.

Highest-severity items rated "less likely":

  • CVE-2026-96207: Partner Center elevation of privilege (EoP), improper certificate validation, CVSS 10.0.
  • CVE-2026-94510: Microsoft Bookings EoP, CVSS 9.9.
  • Outlook RCE, CVSS 9.8 each: CVE-2026-70242, CVE-2026-70291, CVE-2026-88156, CVE-2026-97016 and CVE-2026-97749.
  • CVE-2026-96934: Windows DHCP Server RCE, use after free, CVSS 9.8. Four other DHCP Server RCEs (CVE-2026-88117, -88119, -88120, -88171) are rated 8.1.
  • CVE-2026-100202: Message Queuing (MSMQ) Queue Manager RCE, use after free, CVSS 9.8.
  • CVE-2026-100219 and CVE-2026-105016: QUIC RCE, CVSS 9.8.
  • CVE-2026-70147 and CVE-2026-70153: PostScript Printer Driver RCE, CVSS 9.8.
  • CVE-2026-97814: Text Shaping RCE, CVSS 9.8.
  • CVE-2026-70300 and CVE-2026-88178: Word and PowerPoint RCE, CVSS 9.8.

Cloud and service bugs listed as critical:

  • CVE-2026-77900: Azure App Service RCE, missing authentication for a critical function, CVSS 9.8.
  • CVE-2026-88131: Dataverse RCE, deserialization of untrusted data, CVSS 9.8.
  • CVE-2026-69435: Azure SRE Agent EoP via SSRF, CVSS 9.6.

Other items worth noting:

  • CVE-2026-62840: a Linux Kernel TOCTOU EoP, CVSS 7.0, appears in the list.
  • CVE-2026-69802: NDES RCE, weak authentication, CVSS 8.1.
  • CVE-2026-102866: SharePoint EoP, improper cryptographic signature verification, CVSS 8.1.
  • AD FS spoofing: CVE-2026-96222 and CVE-2026-108131.

Talos also flags roughly 100 "important" bugs that Microsoft rates "more likely". Nearly all are local EoP. The clusters are:

  • Win32k
  • Windows Update and the Update Orchestrator
  • BITS
  • Common Log File System (CLFS): CVE-2026-70233, CVE-2026-85355, CVE-2026-85870
  • Windows Kernel
  • Ancillary Function Driver for WinSock
  • Direct Composition
  • Windows Error Reporting
  • Windows Installer

Outliers in that list:

  • CVE-2026-88159: BITS RCE.
  • CVE-2026-96940 and CVE-2026-70279: Exchange Server EoP and spoofing.
  • CVE-2026-70241: Kerberos EoP.
  • CVE-2026-83769: OpenSSH for Windows EoP.
  • CVE-2026-96858: Security Account Manager (SAM) tampering.

What to do

  • Patch the exploited Windows Shell bug first, then Exchange (CVE-2026-70571, CVE-2026-96940, CVE-2026-70279) and the AD DS bug (CVE-2026-70229).
  • Prioritise internet- or network-reachable services that carry 9.8 scores: DHCP Server, MSMQ, QUIC and Outlook.
  • Deploy the Snort rules. Cisco Secure Firewall customers should update their SRU. Open-source Snort Subscriber Ruleset users should download the latest rule pack. The ranges are:
Snort 2: 1:67210 - 1:67273, 1:67276 - 1:67279, 1:67282 - 1:67311, 1:67313 - 1:67316, 1:67319 - 1:67322
Snort 3: 1:301663 - 1:301694, 1:301696, 1:301702 - 1:301703, 1:301705 - 1:301706, 1:301709, 1:301711, 1:301717 - 1:301718

Caveats

  • Talos says the rules cover only some of the vulnerabilities. Additional rules may follow, and current ones may change.
  • The page does not map rule IDs to CVEs.
  • The page does not describe the Azure and Dataverse fixes or whether customers need to act on them.
  • The exploitability ratings are Microsoft's, not Talos's.

Organisations named here

  • Talos

CVEs named here

  • CVE-2026-96951
  • CVE-2026-70229
  • CVE-2026-70571
  • CVE-2026-105733
  • CVE-2026-102214
  • CVE-2026-108399
  • CVE-2026-100202
  • CVE-2026-100209
  • CVE-2026-100210
  • CVE-2026-100211
  • CVE-2026-97739
  • CVE-2026-97745
  • CVE-2026-97755
  • CVE-2026-97759
  • CVE-2026-97765
  • CVE-2026-97778
  • CVE-2026-97741
  • CVE-2026-97742
  • CVE-2026-97753
  • CVE-2026-97756
  • CVE-2026-97758
  • CVE-2026-97761
  • CVE-2026-97767
  • CVE-2026-97776
  • CVE-2026-97780
  • CVE-2026-100215
  • CVE-2026-100219
  • CVE-2026-105016
  • CVE-2026-100220
  • CVE-2026-102211
  • CVE-2026-88074
  • CVE-2026-108130
  • CVE-2026-108471
  • CVE-2026-96914
  • CVE-2026-102225
  • CVE-2026-97814
  • CVE-2026-102855
  • CVE-2026-102856
  • CVE-2026-102857
  • CVE-2026-102866
  • CVE-2026-62840
  • CVE-2026-69802
  • CVE-2026-70147
  • CVE-2026-70153
  • CVE-2026-108467
  • CVE-2026-70187
  • CVE-2026-70250
  • CVE-2026-83934
  • CVE-2026-88073
  • CVE-2026-88117
  • CVE-2026-88119
  • CVE-2026-88120
  • CVE-2026-88171
  • CVE-2026-96934
  • CVE-2026-96222
  • CVE-2026-108131
  • CVE-2026-96913
  • CVE-2026-96952
  • CVE-2026-105718
  • CVE-2026-108400
  • CVE-2026-108457
  • CVE-2026-108460
  • CVE-2026-70215
  • CVE-2026-88144
  • CVE-2026-88178
  • CVE-2026-88207
  • CVE-2026-70242
  • CVE-2026-70291
  • CVE-2026-88156
  • CVE-2026-97016
  • CVE-2026-97749
  • CVE-2026-70269
  • CVE-2026-70300
  • CVE-2026-83917
  • CVE-2026-94510
  • CVE-2026-96202
  • CVE-2026-96943
  • CVE-2026-96207
  • CVE-2026-69789
  • CVE-2026-88174
  • CVE-2026-88185
  • CVE-2026-69435
  • CVE-2026-77900
  • CVE-2026-83943
  • CVE-2026-83947
  • CVE-2026-88131
  • CVE-2026-100214
  • CVE-2026-102217
  • CVE-2026-69673
  • CVE-2026-69718
  • CVE-2026-69733
  • CVE-2026-69783
  • CVE-2026-69882
  • CVE-2026-69923
  • CVE-2026-69926
  • CVE-2026-70054
  • CVE-2026-70060
  • CVE-2026-70076
  • CVE-2026-70104
  • CVE-2026-70108
  • CVE-2026-70117
  • CVE-2026-70132
  • CVE-2026-70144
  • CVE-2026-70156
  • CVE-2026-70218
  • CVE-2026-70223
  • CVE-2026-70233
  • CVE-2026-70236
  • CVE-2026-70237
  • CVE-2026-70241
  • CVE-2026-70245
  • CVE-2026-70249
  • CVE-2026-70253
  • CVE-2026-70255
  • CVE-2026-70271
  • CVE-2026-70273
  • CVE-2026-70286
  • CVE-2026-70303
  • CVE-2026-72955
  • CVE-2026-81971
  • CVE-2026-83505
  • CVE-2026-83509
  • CVE-2026-83510
  • CVE-2026-83580
  • CVE-2026-83669
  • CVE-2026-83699
  • CVE-2026-83704
  • CVE-2026-83717
  • CVE-2026-83724
  • CVE-2026-83732
  • CVE-2026-83735
  • CVE-2026-83738
  • CVE-2026-83750
  • CVE-2026-83761
  • CVE-2026-83763
  • CVE-2026-83768
  • CVE-2026-83769
  • CVE-2026-83793
  • CVE-2026-83830
  • CVE-2026-83834
  • CVE-2026-83840
  • CVE-2026-83842
  • CVE-2026-83848
  • CVE-2026-83867
  • CVE-2026-83886
  • CVE-2026-83896
  • CVE-2026-83899
  • CVE-2026-83902
  • CVE-2026-83921
  • CVE-2026-84014
  • CVE-2026-85355
  • CVE-2026-85791
  • CVE-2026-85802
  • CVE-2026-85804
  • CVE-2026-85832
  • CVE-2026-85843
  • CVE-2026-85848
  • CVE-2026-85849
  • CVE-2026-85850
  • CVE-2026-85855
  • CVE-2026-85870
  • CVE-2026-85901
  • CVE-2026-85908
  • CVE-2026-85941
  • CVE-2026-85945
  • CVE-2026-88118
  • CVE-2026-88133
  • CVE-2026-88147
  • CVE-2026-88152
  • CVE-2026-88159
  • CVE-2026-88191
  • CVE-2026-96858
  • CVE-2026-96911
  • CVE-2026-96929
  • CVE-2026-96940
  • CVE-2026-69452
  • CVE-2026-69880
  • CVE-2026-69918
  • CVE-2026-70103
  • CVE-2026-70106
  • CVE-2026-70151
  • CVE-2026-70176
  • CVE-2026-70279
  • CVE-2026-83785
  • CVE-2026-83927
  • CVE-2026-85884
  • CVE-2026-85902
  • CVE-2026-85906
  • CVE-2026-88093
  • CVE-2026-96939
  • CVE-2026-97798
  • CVE-2026-97799
  • CVE-2026-97800

Technologies named here

  • Microsoft October 2026 Patch Tuesday
  • Snort 3 ruleset; rule coverage
  • Windows Shell
  • Windows Active Directory Domain Services
  • Cisco Secure Firewall
  • Snort.org Snort Subscriber Ruleset
  • Microsoft Exchange Server
  • Windows Hyper-V
  • Windows Message Queuing / Queue Manager
  • Microsoft Office Excel
  • Microsoft Office Visio
  • Microsoft Office PowerPoint
  • Microsoft Office Outlook
  • Microsoft Office Word
  • Microsoft Office SharePoint
  • Microsoft Graphics Component
  • Microsoft QUIC
  • Windows Media Video Decoder
  • Windows Media Foundation
  • Windows Virtualization-Based Security Enclave
  • Windows Text Shaping
  • Linux kernel
  • Network Device Enrollment Service
  • Microsoft PostScript Printer Driver
  • Windows Remote Desktop Services
  • Windows DHCP Client
  • Windows DHCP Server
  • Windows GDI+
  • Windows Graphics Kernel
  • Active Directory Federation Services
  • Windows Kernel
  • HEVC Video Extensions
  • Microsoft Windows PDF
  • Windows ALPC
  • Microsoft Bookings
  • Windows Raw Image Extension
  • Microsoft Partner Center
  • Windows Reliable Multicast Transport Driver
  • Windows Deployment Services
  • Azure SRE Agent
  • Azure App Service
  • Azure API Center
  • Azure Event Grid
  • Microsoft Dataverse
  • Microsoft Dynamics 365 Business Central
  • WebDAV
  • Windows Update
  • Windows Update Orchestrator Service
  • Windows AI
  • Desktop Window Manager
  • Windows NetBIOS
  • Windows Win32k
  • Windows Common Log File System Driver
  • Windows Ancillary Function Driver for WinSock
  • Windows Kerberos
  • Windows Background Intelligent Transfer Service
  • Windows Installer
  • Windows Error Reporting
  • Windows Search
  • Windows Direct Composition
  • Windows COM+ Event System Service
  • Windows NTFS
  • Windows Encrypting File System
  • Windows Security Account Manager
  • Microsoft OpenSSH for Windows
  • Windows TCP/IP
  • Windows Secure Socket Tunneling Protocol
  • Windows Registry
  • Servicing Stack Updates
  • Windows Management Instrumentation
  • Windows
  • Snort
  • Active Directory
  • Microsoft Office
  • Azure

Techniques named here

  • Remote code execution via memory corruption
  • Elevation of privilege
  • Command injection leading to security feature bypass
  • SSRF
  • Deserialization of untrusted data
  • Spoofing via improper certificate validation
  • Authorization bypass through user-controlled key

Related in Blue Team & Detection