MICROSOFT’S October 2026 Patch Tuesday delivered a sprawling update set, addressing 1417 vulnerabilities across multiple products, with 76 of them rated as critical. Several of the critical issues are cloud-related and were addressed by Microsoft before this Patch Tuesday. Among the issues, one Windows shell security feature bypass has already been exploited: it bypasses the Mark of the Web, allowing an attacker to warn or not warn the user about downloaded files depending on how the message is opened.
There is also a .NET Framework security feature bypass that enables execution of a file and could defeat application controls, though exploitation requires the malicious file to reach the user.
A notable spotlight falls on Windows DHCP Server, which has 10 remote code execution (RCE) vulnerabilities addressed, five of which are rated critical. Microsoft also patched a remote code execution vulnerability in Exchange Server; Microsoft says exploitation is less likely and would require substantial knowledge of the target environment to craft a successful exploit, despite the fact that sending a crafted email could trigger the issue during processing.
Office remains a frequent target with numerous remote code execution vulnerabilities, though the updates span multiple products rather than one concentrated package. Beyond Microsoft, Ivanti released October 2026 security updates for Ivanti Connect Secure (one vulnerability already being exploited in limited attacks) and for Ivanti Neurons patch for Intune and Extraction, where one issue could leak Ivanti Neurons credentials used to connect to Microsoft Intune, prompting credential rotation alongside the patch.
Adobe’s fixes cover 11 products, including critical vulnerabilities in Adobe Commerce and ColdFusion (server-side RPS and unrestricted file upload issues). Overall, apply affected patches relevant to your product usage and environments, prioritising critical RCE and publicly exploited flaws.