Microsoft October Patch Tuesday Fixes 1,415 Flaws Including Exploited Shell Zero-Day
Microsoft’s October 2026 update addresses over 1,400 vulnerabilities, including a critical Windows Shell flaw already exploited in the wild.
Key points
- Microsoft released patches for 1,415 vulnerabilities in October 2026, marking its largest update to date.
- One vulnerability, CVE-2026-96951 in Windows Shell, is confirmed to be exploited in the wild.
- The update includes 85 critical flaws, with 67 allowing remote code execution.
Microsoft released its monthly security update for October 2026, addressing 1,415 vulnerabilities across its product portfolio. According to Cisco Talos, the release includes 85 vulnerabilities marked as critical by Microsoft. One of these flaws has been confirmed to be exploited in the wild, requiring immediate attention from security teams.
The actively exploited vulnerability is CVE-2026-96951, a security feature bypass in Windows Shell. Cisco Talos identifies the weakness as improper neutralization of special elements used in a command, resulting in command injection. The flaw carries a CVSS base score of 8.8. As Threat Times reported on 2026-10-13, Microsoft patched this high-severity issue before the official Patch Tuesday release.
Context and Background
Cisco Talos notes that 67 of the 85 critical vulnerabilities allow remote code execution. Microsoft considers the exploitation of certain other flaws more likely, including CVE-2026-70229 in Windows Active Directory Domain Services. That flaw involves incorrect authorization and has a CVSS score of 8.1. Another likely target is CVE-2026-70571 in Microsoft Exchange Server, which involves a stack-based buffer overflow and also scores 8.1.
Microsoft considers exploitation less likely for several other high-severity issues. These include three flaws in Windows Hyper-V: CVE-2026-105733 and CVE-2026-102214, both allowing remote code execution with CVSS scores of 8.8. CVE-2026-108399 allows elevation of privilege with a score of 7.2. Additionally, CVE-2026-100202 in Windows Message Queuing Queue Manager allows remote code execution with a CVSS score of 9.8.
Who is affected
The update addresses numerous flaws in Microsoft Office Excel. Eighteen remote code execution vulnerabilities, each with a CVSS score of 8.8, affect the application. These include CVE-2026-100209, CVE-2026-100210, and CVE-2026-100211, among others. Weaknesses include use-after-free errors, heap-based buffer overflows, and integer underflows. Users opening untrusted files remain at risk until these patches are applied.
Other affected components include the Microsoft Graphics Component, which has a remote code execution flaw (CVE-2026-100215) with a CVSS score of 7.8. Microsoft QUIC contains two remote code execution vulnerabilities, CVE-2026-100219 and CVE-2026-105016, both scoring 9.8. The Windows Media Video Decoder also has a remote code execution flaw, CVE-2026-100220, with a CVSS score of 8.8.
What should you do?
Security teams should prioritize patching systems affected by CVE-2026-96951 immediately, given its active exploitation. Administrators should also review their deployment of Active Directory Domain Services and Exchange Server to address the flaws Microsoft deems more likely to be exploited. Organizations should assess their exposure to remote code execution vulnerabilities in Excel and other client-side applications.
What to do and how to stay safe: Microsoft
- Apply the October 2026 security updates to all systems running Windows Shell to mitigate the exploited zero-day vulnerability.
- Review and patch servers running Active Directory Domain Services and Exchange Server to address high-likelihood remote code execution flaws.
- Update Microsoft Office Excel installations to protect against the 18 identified remote code execution vulnerabilities.
- Monitor network traffic for signs of exploitation related to the Windows Message Queuing and Microsoft QUIC components.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many vulnerabilities did Microsoft fix in October 2026?
Microsoft addressed 1,415 vulnerabilities in its October 2026 security update, according to Cisco Talos.
Which vulnerability is being exploited in the wild?
CVE-2026-96951, a command injection flaw in Windows Shell, is confirmed to be exploited in the wild.
How many critical vulnerabilities allow remote code execution?
Out of 85 critical vulnerabilities, 67 allow remote code execution, according to Cisco Talos.
