Microsoft: October 2026 Patch Tuesday fixes 1,413 CVEs incl. two zero-days, one actively exploited (CVE-2026-96951, CVE-2026-108398)
Severity: critical · Patch status: patched · Since 2026-10-13 · CVE-2026-102208, CVE-2026-102866, CVE-2026-108398, CVE-2026-21413, CVE-2026-70242, CVE-2026-96951
Microsoft's October 2026 Patch Tuesday, its largest update ever, fixes 1,413 CVEs (1,102 in Windows), including 80 critical flaws and two zero-days. CVE-2026-96951 (CVSS 8.8), a Windows Shell Mark-of-the-Web bypass under active exploitation (discovered by Anthropic's Claude AI), lets crafted files skip SmartScreen, Office Protected View, macro blocking and Smart App Control. CVE-2026-108398 (CVSS 8.8) is a .NET Framework untrusted search path enabling code execution inside WDAC-protected processes; no active exploitation confirmed. Also critical: Outlook Reading Pane RCE CVE-2026-70242 (CVSS 9.8) triggering via email preview without interaction, and SharePoint EoP CVE-2026-102866 (CVSS 8.1). Fixes are available in the October updates.
What to do
- Deploy Microsoft's October 2026 security updates immediately across all Windows endpoints and servers, prioritizing internet-facing and WDAC-protected systems
- Patch Outlook against CVE-2026-70242 (CVSS 9.8) as a top priority given no user interaction is required
- Patch SharePoint Server against CVE-2026-102866 and review token issuance/proof-token exposure
- Update .NET Framework everywhere, especially WDAC-protected environments, and monitor for suspicious assembly loading
- Harden against MOTW bypasses: don't rely solely on SmartScreen/Protected View/macros policy; consider blocking risky file types at mail gateway
Sources
All live incidents on Threat Watch