MICROSOFT’S October 2026 Patch Tuesday patches across a wide attack surface, addressing 1,417 disclosed vulnerabilities, with 76 rated as critical. The update set includes fixes for a substantial number of Office and .NET/Framework components, plus notable remote code execution fixes in Windows DHCP Server, Exchange Server, and various Windows subsystems. The patch batch also features one vulnerability disclosed prior to today’s release and one that has already been exploited in the wild.
The most concrete exploitation noted is CVE-2026-96951, a Windows Shell Security Feature Bypass that can facilitate code execution by bypassing the Mark of the Web when a user opens a malicious file sent via email or instant messaging; the compromise still requires the user to open the file. Another item with evidence of exploitation is CVE-2026-108398, a .NET Framework security feature bypass; Microsoft reports no active exploitation in the wild for this one at release, though details were public before today.
In addition, Windows DHCP Server now hosts 10 remote code execution vulnerabilities, five of which are critical, and Microsoft Exchange Server faces CVE-2026-70571, a remote code execution vulnerability triggered by processing a crafted email during content conversion. Office vulnerabilities are particularly numerous and are expected to demand prompt remediation.