MICROSOFT’S October 2026 Patch Tuesday swells to a much larger cycle than last month, with 1,413 disclosed vulnerabilities across its own products, of which 1,102 are in Windows. The post notes that vulnerability volumes are continuing to rise across the industry. Microsoft states exploitation in the wild for just one vulnerability in this release, and public disclosure for two others. The report highlights several notable entries and by‑product concerns, including a zero‑day in Windows Shell that has been observed in the wild.
The most consequential item is CVE-2026-96951, a zero‑day in the Windows Shell (the GUI interaction layer exposed by explorer[.]exe and related components) that provides a Mark of the Web bypass and can be triggered by opening a crafted file or visiting a malicious site. Outlook also receives multiple no‑interaction RCE fixes in this batch: CVE-2026-70242, CVE-2026-97749, CVE-2026-97016, CVE-2026-88156 and CVE-2026-70291, all tied to the preview pane.
In addition, a notable six‑digit entry appears for .NET Framework: CVE-2026-108398, a security feature bypass that requires an attacker with foothold to load a malicious assembly, bypassing WDAC/App Control. The Edge notes show updates delivered but with CVEs “added soon” and no explicit vulnerability list yet.
The piece also covers lifecycle moves: Windows 11 24H2 Home/Pro reach end of servicing; Windows Server 2022 to extended support; ESU for Server 2012/2012 R2 ending on 14 October 2026; Office 2021 retirement on 14 October; and Exchange Server ESU changes from 15 October.