Microsoft's October 2026 security update fixes 1,415 vulnerabilities, and one of them is already being exploited in the wild. That flaw, CVE-2026-96951 in Windows Shell, belongs at the front of every patch queue, according to Cisco Talos researcher Nick Biasini's breakdown of the release.
Microsoft rated 85 of this month's bugs critical, and 67 of those allow remote code execution. CISA added CVE-2026-96951 to its Known Exploited Vulnerabilities catalog on October 13, which puts US federal agencies on a remediation clock.
The one bug attackers are already using
Microsoft classifies CVE-2026-96951 as a security feature bypass in Windows Shell, with an underlying weakness of command injection and a CVSS base score of 8.8. CISA's catalog lists it as a Microsoft Windows command injection vulnerability. Neither source says how it is being exploited or by whom, and Microsoft's advisory carries the detail.
Two more Microsoft expects attackers to target
Microsoft flags two flaws as exploitation more likely, each with a CVSS score of 8.1:
- CVE-2026-70229, remote code execution in Windows Active Directory Domain Services (incorrect authorization)
- CVE-2026-70571, remote code execution in Microsoft Exchange Server (stack-based buffer overflow)
Domain controllers and Exchange servers are central to most corporate networks, which makes these two worth prioritizing even without known attacks.
A long list of 9.8s in Windows and Office
Several Windows and Office remote code execution flaws carry a CVSS score of 9.8. Microsoft has not marked any of them as exploited:
- CVE-2026-100202, Windows Message Queuing Queue Manager (use after free)
- CVE-2026-100219 and CVE-2026-105016, Microsoft QUIC (use after free, and heap-based buffer overflow)
- CVE-2026-97814, Windows Text Shaping (heap-based buffer overflow)
- CVE-2026-70147 and CVE-2026-70153, Microsoft PostScript Printer Driver (heap-based buffer overflow)
- CVE-2026-96934, Windows DHCP Server (use after free)
- CVE-2026-88178, Microsoft Office PowerPoint (use after free)
- CVE-2026-70242, CVE-2026-70291, CVE-2026-88156, CVE-2026-97016 and CVE-2026-97749, Microsoft Office Outlook (buffer overflows and a double free)
The top scores this month sit in Microsoft's cloud services rather than on-premises software: an elevation of privilege flaw in Microsoft Partner Center scores 10.0 (CVE-2026-96207) and one in Microsoft Bookings scores 9.9 (CVE-2026-94510).
Office gets a heavy share of the month too. Talos counts 18 remote code execution bugs in Excel alone, each scored 8.8, alongside fixes for Visio, PowerPoint and Hyper-V. Five elevation of privilege flaws in the Windows Virtualization-Based Security (VBS) Enclave score between 7.0 and 8.8.
Patch Windows Shell first, then domain controllers and Exchange
Apply the October cumulative updates, starting with every system exposed to CVE-2026-96951, then domain controllers and Exchange servers, then the internet-facing services on the 9.8 list. Talos has also published Snort rules covering several of this month's vulnerabilities; the rule list is in its post.
Last month Microsoft fixed two Windows bugs already under attack. October has only one, but at 1,415 fixes the sheer volume makes triage essential, so the bug attackers are already using does not get lost in the pile.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.