Microsoft's October 2026 Patch Tuesday fixes over 1,400 flaws including an exploited Windows Shell bypass

Microsoft shipped its October 2026 Patch Tuesday batch on 13 October, and by either of the two public tallies it addresses more than 1,400 separate vulnerabilities across Windows, Office, Exchange Server, Microsoft's QUIC implementation, the PostScript printer driver, DHCP Server and Message Queuing. A dev.to write-up of the release notes that CrowdStrike counts 1,413 vulnerabilities while the SANS Internet Storm Center diary, written by Johannes Ullrich, counts 1,417 — a four-flaw gap that neither tracker explains, so any figure quoted should name its source.

One flaw is already being exploited

The release's single confirmed exploited zero-day is CVE-2026-96951, a Windows Shell security feature bypass rated Important with a CVSS score of 8.8. According to the dev.to analysis, it removes the Mark of the Web tag from downloaded files — the tag that SmartScreen and Office's Protected View consult before a file is allowed to run. Once the tag is stripped, those downstream warnings stop applying, though SANS points out that the victim still has to open the file, so the attack relies on social engineering.

CISA treated it as urgent: the agency added the CVE to its Known Exploited Vulnerabilities catalogue on 13 October, the same day the patches shipped, with a remediation deadline of 16 October 2026. That three-day window is tighter than most organisations' normal update schedules. There is also a reconciliation snag — CISA labels the flaw a "Microsoft Windows Command Injection Vulnerability" while Microsoft classifies it as a security feature bypass, so matching the two records by title fails and the CVE identifier is the dependable link between them.

A second bypass targets application allow-listing

CVE-2026-108398, a .NET Framework flaw also rated Important at CVSS 8.8, had details published before the release. CrowdStrike describes it as a bypass of Windows Defender Application Control that requires an authenticated attacker with local access to place a crafted .NET assembly on the system; SANS reports Microsoft had detected no exploitation at publication time. The dev.to piece argues that for estates that treat allow-listing as a primary control on administrative workstations, this bypass deserves priority over higher-scoring flaws that need network reachability the attacker may not have.

AD FS spoofing and the critical RCE pile

Two AD FS spoofing vulnerabilities, CVE-2026-108131 (CVSS 7.5) and CVE-2026-96222 (CVSS 7.4), are both rated Critical by Microsoft and both let an unauthenticated network attacker impersonate the federation service, according to the dev.to analysis citing CrowdStrike. Because authentication flows through the federation service, every application trusting it is exposed along with it, which is why the modest scores understate the impact. The second flaw stems from improper certificate validation and, per CrowdStrike, demands high attack complexity because of configuration and environmental dependencies. Organisations that have moved authentication to a cloud identity provider are not exposed to this particular pair. The identity tier also contains CVE-2026-70229, a Critical remote code execution flaw in Active Directory Domain Services scored at CVSS 8.1.

Office applications carry the largest block of critical bugs: twenty remote code execution flaws spread across Excel, PowerPoint, Visio and Word, six of them triggerable through the Preview Pane, plus five Outlook RCEs scored at CVSS 9.8, two of which are reachable from the Reading Pane.

What the batch is made of

The breakdown matters more than the headline total. Per the dev.to analysis, elevation of privilege accounts for 677 patches (48%), remote code execution for 317 (22%) and information disclosure for 254 (18%). Fifteen vulnerabilities permit unauthenticated remote code execution over the network, spread across DHCP Server, QUIC, the PostScript printer driver and PDF handling. CrowdStrike's tally also includes two flaws disclosed publicly before patches existed, while SANS notes seven critical flaws that require no customer action from administrators.

Why it matters

This release lands on two sets of trust mechanisms at once: the checks that decide whether code from outside may run (Mark of the Web and application allow-listing) and the identity infrastructure that other systems depend on (AD DS and AD FS). A workable triage order, as the dev.to analysis suggests, starts with the exploited Windows Shell flaw — whose CISA deadline has already passed — then internet-facing federation services, then the network services that respond before authentication. The four-flaw gap between CrowdStrike and SANS ISC is a smaller but practical lesson: patch statistics should always be attributed to the tracker that produced them, or the number cannot be reconciled later.