Microsoft's October 2026 Patch Tuesday landed on 13 October with around 1,400 CVEs. Tenable counted 1,407, others counted 1,413, depending on what they included. Either way, it's a record.
Nobody can read 1,400 advisories. So here is what matters, in order.
1. The exploited zero-day: CVE-2026-96951
This is a Windows Shell security feature bypass, CVSS 8.8, and attackers were already using it.
In simple words: when you download a file from the internet, Windows tags it with something called Mark of the Web (MOTW). That tag is what makes Windows show warnings, and makes Office open files in Protected View. This bug lets an attacker's file skip that tag, so the warnings never appear.
The attack needs a person to open a file, usually sent by email or chat. CISA added it to its Known Exploited list and gave US federal agencies until 16 October to patch, which shows how urgent they think it is. It's also the third Windows Shell bug exploited this year.
2. Publicly disclosed: CVE-2026-108398 (.NET)
A .NET Framework bug that could let a malicious assembly get loaded by a protected process, bypassing Windows Defender Application Control (WDAC). It was public before the patch, though not reported as exploited.
3. Critical for servers
- CVE-2026-70229: remote code execution in Active Directory Domain Services through a crafted packet. Microsoft rates exploitation "more likely". Patch your domain controllers.
- CVE-2026-70571: remote code execution in Exchange Server through a malicious email.
What I would do, in order
- Push the update to user laptops first, because the zero-day needs a user to open a file.
- Patch domain controllers and Exchange next.
- Find unsupported systems. Windows Server 2012 / 2012 R2 extended updates have ended, and Windows 11 24H2 Home and Pro reached end of support. They won't get these fixes.
A network person's view
MOTW bypasses are a good reason not to rely on one layer. If your secure web gateway or proxy sandboxes files before download, and your email security strips risky attachments, a bypass on the endpoint has much less chance of working. Defence in depth isn't a buzzword when the last layer has a hole.
Personal view only. Always check Microsoft's Security Update Guide for your systems.
Comments
No comments yet. Share your own debugging war story.