Microsoft has released its monthly security update for October 2026, which includes 1415 vulnerabilities affecting a range of products, including 85 that Microsoft marked as "critical."
Microsoft notes that 1 of the vulnerabilities disclosed this month have been exploited in the wild
CVE-2026-96951 is a security feature bypass vulnerability that affects Windows Shell. The shared weakness is Improper Neutralization of Special Elements used in a Command ('Command Injection'). The vulnerability has a CVSS base score of 8.8.
Out of 85 "critical" vulnerabilities, 67 are remote code execution (RCE) vulnerabilities.
Microsoft considers exploitation of the following vulnerabilities more likely.
CVE-2026-70229 is a remote code execution vulnerability that affects Windows Active Directory Domain Services. The shared weakness is Incorrect Authorization. The vulnerability has a CVSS base score of 8.1.
CVE-2026-70571 is a remote code execution vulnerability that affects Microsoft Exchange Server. The shared weakness is Stack-based Buffer Overflow. The vulnerability has a CVSS base score of 8.1.
Microsoft considers exploitation of the following vulnerabilities less likely.
CVE-2026-105733, CVE-2026-102214, and CVE-2026-108399 affect Windows Hyper-V. CVE-2026-105733 has an impact of remote code execution; involves Incorrect Initialization of Resource; has a CVSS base score of 8.8. CVE-2026-102214 has an impact of remote code execution; involves Use After Free; has a CVSS base score of 8.8. CVE-2026-108399 has an impact of elevation of privilege; involves Heap-based Buffer Overflow; has a CVSS base score of 7.2.
CVE-2026-100202 is a remote code execution vulnerability that affects Windows Message Queuing Queue Manager. The shared weakness is Use After Free. The vulnerability has a CVSS base score of 9.8.
CVE-2026-100209, CVE-2026-100210, CVE-2026-100211, CVE-2026-97739, CVE-2026-97745, CVE-2026-97755, CVE-2026-97759, CVE-2026-97765, CVE-2026-97778, CVE-2026-97741, CVE-2026-97742, CVE-2026-97753, CVE-2026-97756, CVE-2026-97758, CVE-2026-97761, CVE-2026-97767, CVE-2026-97776, and CVE-2026-97780 are remote code execution vulnerabilities that affect Microsoft Office Excel. Each has a CVSS base score of 8.8. CVE-2026-100209, CVE-2026-100211, CVE-2026-97745, and CVE-2026-97759 involve Use After Free. CVE-2026-100210, CVE-2026-97765 , CVE-2026-97756, CVE-2026-97758, CVE-2026-97776, and CVE-2026-97780 involve Heap-based Buffer Overflow. CVE-2026-97739 involves Heap-based Buffer Overflow and Integer Underflow (Wrap or Wraparound). CVE-2026-97755 involves Out-of-bounds Read. CVE-2026-97778 involves Integer Overflow or Wraparound. CVE-2026-97741 involves Heap-based Buffer Overflow and Off-by-one Error. CVE-2026-97742 involves Stack-based Buffer Overflow. CVE-2026-97753 involves Heap-based Buffer Overflow and Integer Overflow or Wraparound. CVE-2026-97761 involves Stack-based Buffer Overflow. CVE-2026-97767 involves Double Free and NULL Pointer Dereference.
CVE-2026-100215 is a remote code execution vulnerability that affects Microsoft Graphics Component. The shared weakness is Heap-based Buffer Overflow. The vulnerability has a CVSS base score of 7.8.
CVE-2026-100219 and CVE-2026-105016 are remote code execution vulnerabilities that affect Microsoft QUIC. Each has a CVSS base score of 9.8. CVE-2026-100219 involves Use After Free. CVE-2026-105016 involves Heap-based Buffer Overflow.
CVE-2026-100220 is a remote code execution vulnerability that affects Windows Media Video Decoder. The shared weakness is Heap-based Buffer Overflow. The vulnerability has a CVSS base score of 8.8.
CVE-2026-102211, CVE-2026-88074, CVE-2026-108130, CVE-2026-108471, and CVE-2026-96914 are elevation of privilege vulnerabilities that affect Windows Virtualization-Based Security (VBS) Enclave. CVE-2026-102211 involves Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') and Use After Free; has a CVSS base score of 7.0. CVE-2026-88074 involves Integer Overflow or Wraparound; has a CVSS base score of 7.8. CVE-2026-108130 involves Heap-based Buffer Overflow; has a CVSS base score of 7.8. CVE-2026-108471 involves Untrusted Pointer Dereference; has a CVSS base score of 8.8. CVE-2026-96914 involves Heap-based Buffer Overflow and Integer Overflow or Wraparound; has a CVSS base score of 8.8.
CVE-2026-102225 and CVE-2026-97814 are remote code execution vulnerabilities that affect Windows Text Shaping. CVE-2026-102225 involves Numeric Truncation Error and Out-of-bounds Read; has a CVSS base score of 8.8. CVE-2026-97814 involves Heap-based Buffer Overflow; has a CVSS base score of 9.8.
CVE-2026-102855, CVE-2026-102856, and CVE-2026-102857 are remote code execution vulnerabilities that affect Microsoft Office Visio. The shared weakness is Heap-based Buffer Overflow. Each has a CVSS base score of 8.8. CVE-2026-102856 involves Integer Overflow or Wraparound. CVE-2026-102857 involves Off-by-one Error.
CVE-2026-102866 is an elevation of privilege vulnerability that affects Microsoft Office SharePoint. The shared weakness is Improper Verification of Cryptographic Signature. The vulnerability has a CVSS base score of 8.1.
CVE-2026-62840 is an elevation of privilege vulnerability that affects Linux Kernel. The shared weakness is Time-of-check Time-of-use (TOCTOU) Race Condition. The vulnerability has a CVSS base score of 7.0.
CVE-2026-69802 is a remote code execution vulnerability that affects Network Device Enrollment Service (NDES). The shared weakness is Weak Authentication. The vulnerability has a CVSS base score of 8.1.
CVE-2026-70147, CVE-2026-70153, and CVE-2026-108467 are remote code execution vulnerabilities that affect Microsoft PostScript Printer Driver. The shared weakness is Heap-based Buffer Overflow. CVE-2026-70147 has a CVSS base score of 9.8. CVE-2026-70153 has a CVSS base score of 9.8. CVE-2026-108467 has a CVSS base score of 8.8.
CVE-2026-70187 is a remote code execution vulnerability that affects Windows Remote Desktop Services. The shared weakness is Use After Free. The vulnerability has a CVSS base score of 8.1.
CVE-2026-70250 is a remote code execution vulnerability that affects Windows DHCP Client. The shared weakness is Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') and Use After Free. The vulnerability has a CVSS base score of 8.8.
CVE-2026-83934 is a remote code execution vulnerability that affects Windows GDI+. The shared weakness is Stack-based Buffer Overflow. The vulnerability has a CVSS base score of 8.8.
CVE-2026-88073 is an elevation of privilege vulnerability that affects Windows Graphics Kernel. The shared weakness is Use After Free. The vulnerability has a CVSS base score of 8.8.
CVE-2026-88117, CVE-2026-88119, CVE-2026-88120, CVE-2026-88171, and CVE-2026-96934 are remote code execution vulnerabilities that affect Windows DHCP Server. CVE-2026-88117, CVE-2026-88119, and CVE-2026-88120 involve Use After Free; each has a CVSS base score of 8.1. CVE-2026-88171 involves Double Free; has a CVSS base score of 8.1. CVE-2026-96934 involves Use After Free; has a CVSS base score of 9.8.
CVE-2026-96222 and CVE-2026-108131 are spoofing vulnerabilities that affect Active Directory Federation Services (AD FS). CVE-2026-96222 involves Improper Certificate Validation; has a CVSS base score of 7.4. CVE-2026-108131 has a CVSS base score of 7.5.
CVE-2026-96913 is an elevation of privilege vulnerability that affects Windows Kernel. The shared weakness is Heap-based Buffer Overflow. The vulnerability has a CVSS base score of 8.8.
CVE-2026-96952 is a remote code execution vulnerability that affects Microsoft Windows Media Foundation. The shared weakness is Heap-based Buffer Overflow. The vulnerability has a CVSS base score of 8.8.
CVE-2026-105718 is a remote code execution vulnerability that affects Microsoft Excel. The shared weakness is Improper Input Validation and Out-of-bounds Read. The vulnerability has a CVSS base score of 8.8.
CVE-2026-108400 is a remote code execution vulnerability that affects HEVC Video Extensions. The shared weakness is Integer Overflow or Wraparound. The vulnerability has a CVSS base score of 8.8.
CVE-2026-108457 is a remote code execution vulnerability that affects Microsoft Windows PDF. The shared weakness is Out-of-bounds Write. The vulnerability has a CVSS base score of 8.1.
CVE-2026-108460 is a remote code execution vulnerability that affects Windows Message Queuing. The shared weakness is Use After Free. The vulnerability has a CVSS base score of 8.1.
CVE-2026-70215, CVE-2026-88144, CVE-2026-88178, and CVE-2026-88207 are remote code execution vulnerabilities that affect Microsoft Office PowerPoint. CVE-2026-70215 and CVE-2026-88144 involve Use After Free; has a CVSS base score of 8.8. CVE-2026-88178 involves Use After Free; has a CVSS base score of 9.8. CVE-2026-88207 involves Heap-based Buffer Overflow; has a CVSS base score of 7.5.
CVE-2026-70242, CVE-2026-70291, CVE-2026-88156, CVE-2026-97016, and CVE-2026-97749 are remote code execution vulnerabilities that affect Microsoft Office Outlook. Each has a CVSS base score of 9.8. CVE-2026-70242, CVE-2026-70291, and CVE-2026-97016 involve Heap-based Buffer Overflow. CVE-2026-88156 involves Stack-based Buffer Overflow. CVE-2026-97749 involves Double Free.
CVE-2026-70269 and CVE-2026-70300 are remote code execution vulnerabilities that affect Microsoft Office Word. CVE-2026-70269 involves Heap-based Buffer Overflow and Integer Overflow or Wraparound; has a CVSS base score of 8.1. CVE-2026-70300 involves Untrusted Pointer Dereference; has a CVSS base score of 9.8.
CVE-2026-83917 is an elevation of privilege vulnerability that affects Windows ALPC. The shared weakness is Use After Free. The vulnerability has a CVSS base score of 7.0.
CVE-2026-94510 is an elevation of privilege vulnerability that affects Microsoft Bookings. The shared weakness is Authorization Bypass Through User-Controlled Key. The vulnerability has a CVSS base score of 9.9.
CVE-2026-96202 and CVE-2026-96943 are remote code execution vulnerabilities that affect Windows Raw Image Extension. The shared weakness is Heap-based Buffer Overflow. Each has a CVSS base score of 8.8. CVE-2026-96943 involves Integer Overflow or Wraparound.
CVE-2026-96207 is an elevation of privilege vulnerability that affects Microsoft Partner Center. The shared weakness is Improper Certificate Validation. The vulnerability has a CVSS base score of 10.0.
Microsoft considers exploitation of the following vulnerabilities unlikely.
CVE-2026-69789 is a remote code execution vulnerability that affects Windows Reliable Multicast Transport Driver (RMCAST). The shared weakness is Heap-based Buffer Overflow. The vulnerability has a CVSS base score of 7.5.
CVE-2026-88174 is a remote code execution vulnerability that affects Windows Deployment Services. The shared weakness is Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'). The vulnerability has a CVSS base score of 8.1.
CVE-2026-88185 is a remote code execution vulnerability that affects Microsoft Office Word. The shared weakness is Heap-based Buffer Overflow. The vulnerability has a CVSS base score of 8.1.
Other critical vulnerabilities
CVE-2026-69435 is an elevation of privilege vulnerability that affects Azure SRE Agent. The shared weakness is Server-Side Request Forgery (SSRF). The vulnerability has a CVSS base score of 9.6.
CVE-2026-77900 is a remote code execution vulnerability that affects Azure App Service. The shared weakness is Missing Authentication for Critical Function. The vulnerability has a CVSS base score of 9.8.
CVE-2026-83943 is an information disclosure vulnerability that affects Azure API Center. The vulnerability has a CVSS base score of 8.7.
CVE-2026-83947 is a spoofing vulnerability that affects Azure Event Grid. The shared weakness is Missing Authorization. The vulnerability has a CVSS base score of 7.7.
CVE-2026-88131 is a remote code execution vulnerability that affects Microsoft Dataverse. The shared weakness is Deserialization of Untrusted Data. The vulnerability has a CVSS base score of 9.8.
Talos would also like to highlight the following "important" vulnerabilities as Microsoft has determined that their exploitation is "more likely:"
CVE-2026-100214: Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability
CVE-2026-102217: WebDAV Elevation of Privilege Vulnerability
CVE-2026-69673: Windows Update Elevation of Privilege Vulnerability
CVE-2026-69718: Windows Update Elevation of Privilege Vulnerability
CVE-2026-69733: Windows Update Elevation of Privilege Vulnerability
CVE-2026-69783: Windows Update Elevation of Privilege Vulnerability
CVE-2026-69882: Windows Update Elevation of Privilege Vulnerability
CVE-2026-69923: Windows AI Elevation of Privilege Vulnerability
CVE-2026-69926: Desktop Window Manager Elevation of Privilege Vulnerability
CVE-2026-70054: Windows NetBIOS Elevation of Privilege Vulnerability
CVE-2026-70060: Windows Win32k Elevation of Privilege Vulnerability
CVE-2026-70076: Windows Win32k Elevation of Privilege Vulnerability
CVE-2026-70104: Windows Win32k Elevation of Privilege Vulnerability
CVE-2026-70108: Windows Win32k Elevation of Privilege Vulnerability
CVE-2026-70117: Windows Win32k Elevation of Privilege Vulnerability
CVE-2026-70132: Windows Portable Device File System Driver Elevation of Privilege Vulnerability
CVE-2026-70144: Windows Win32k Elevation of Privilege Vulnerability
CVE-2026-70156: Microsoft Windows Search Component Elevation of Privilege Vulnerability
CVE-2026-70218: Windows StateRepository API Elevation of Privilege Vulnerability
CVE-2026-70223: Windows Console Driver Elevation of Privilege Vulnerability
CVE-2026-70233: Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2026-70236: Windows Win32k Elevation of Privilege Vulnerability
CVE-2026-70237: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
CVE-2026-70241: Windows Kerberos Elevation of Privilege Vulnerability
CVE-2026-70245: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
CVE-2026-70249: Windows Win32k Elevation of Privilege Vulnerability
CVE-2026-70253: Windows Win32k Elevation of Privilege Vulnerability
CVE-2026-70255: Desktop Window Manager Elevation of Privilege Vulnerability
CVE-2026-70271: Windows Win32k Elevation of Privilege Vulnerability
CVE-2026-70273: Windows Win32k Elevation of Privilege Vulnerability
CVE-2026-70286: Windows Graphics Component Elevation of Privilege Vulnerability
CVE-2026-70303: Windows Kernel Elevation of Privilege Vulnerability
CVE-2026-72955: Windows Application Compatibility Cache Elevation of Privilege Vulnerability
CVE-2026-81971: Windows NTFS Elevation of Privilege Vulnerability
CVE-2026-83505: Windows Setup Files Cleanup Elevation of Privilege Vulnerability
CVE-2026-83509: Windows Setup Files Cleanup Elevation of Privilege Vulnerability
CVE-2026-83510: Windows Setup Files Cleanup Elevation of Privilege Vulnerability
CVE-2026-83580: Windows Client-Side Caching (CSC) Service Elevation of Privilege Vulnerability
CVE-2026-83669: Windows Error Reporting Elevation of Privilege Vulnerability
CVE-2026-83699: Windows Client-Side Caching (CSC) Service Elevation of Privilege Vulnerability
CVE-2026-83704: Microsoft Windows Search Component Elevation of Privilege Vulnerability
CVE-2026-83717: Windows Installer Elevation of Privilege Vulnerability
CVE-2026-83724: Windows Management Instrumentation Elevation of Privilege Vulnerability
CVE-2026-83732: Win32k Elevation of Privilege Vulnerability
CVE-2026-83735: Windows Kernel Elevation of Privilege Vulnerability
CVE-2026-83738: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
CVE-2026-83750: Windows Error Reporting Elevation of Privilege Vulnerability
CVE-2026-83761: Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
CVE-2026-83763: Windows Input System Elevation of Privilege Vulnerability
CVE-2026-83768: Windows Kernel Elevation of Privilege Vulnerability
CVE-2026-83769: Microsoft OpenSSH for Windows Elevation of Privilege Vulnerability
CVE-2026-83793: Windows Update Orchestrator Service Elevation of Privilege Vulnerability
CVE-2026-83830: Windows COM+ Event System Service Elevation of Privilege Vulnerability
CVE-2026-83834: Windows Kernel-Mode Drivers Elevation of Privilege Vulnerability
CVE-2026-83840: Windows Error Reporting Elevation of Privilege Vulnerability
CVE-2026-83842: Windows TCP/IP Elevation of Privilege Vulnerability
CVE-2026-83848: Windows COM+ Event System Service Elevation of Privilege Vulnerability
CVE-2026-83867: Windows Push Notifications Elevation of Privilege Vulnerability
CVE-2026-83886: Windows Update Orchestrator Service Elevation of Privilege Vulnerability
CVE-2026-83896: Windows Direct Composition Elevation of Privilege Vulnerability
CVE-2026-83899: Windows Installer Elevation of Privilege Vulnerability
CVE-2026-83902: Windows Direct Composition Elevation of Privilege Vulnerability
CVE-2026-83921: Windows Search Service Elevation of Privilege Vulnerability
CVE-2026-84014: Windows Device Association Service Elevation of Privilege Vulnerability
CVE-2026-85355: Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2026-85791: Windows Encrypting File System (EFS) Elevation of Privilege Vulnerability
CVE-2026-85802: Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
CVE-2026-85804: Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
CVE-2026-85832: Windows Background Intelligent Transfer Service (BITS) Elevation of Privilege Vulnerability
CVE-2026-85843: Windows Background Intelligent Transfer Service (BITS) Elevation of Privilege Vulnerability
CVE-2026-85848: Windows Background Intelligent Transfer Service (BITS) Elevation of Privilege Vulnerability
CVE-2026-85849: Windows AppX Deployment Service Elevation of Privilege Vulnerability
CVE-2026-85850: Windows Kernel Elevation of Privilege Vulnerability
CVE-2026-85855: Windows DWM Core Library Elevation of Privilege Vulnerability
CVE-2026-85870: Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2026-85901: Windows Graphics Component Elevation of Privilege Vulnerability
CVE-2026-85908: Windows Graphics Component Elevation of Privilege Vulnerability
CVE-2026-85941: Windows Installer Elevation of Privilege Vulnerability
CVE-2026-85945: Windows Kernel Elevation of Privilege Vulnerability
CVE-2026-88118: Windows Background Intelligent Transfer Service (BITS) Elevation of Privilege Vulnerability
CVE-2026-88133: Windows Portable Device Enumerator Service Elevation of Privilege Vulnerability
CVE-2026-88147: Windows Secure Socket Tunneling Protocol (SSTP) Elevation of Privilege Vulnerability
CVE-2026-88152: Windows Background Intelligent Transfer Service (BITS) Elevation of Privilege Vulnerability
CVE-2026-88159: Windows Background Intelligent Transfer Service (BITS) Remote Code Execution Vulnerability
CVE-2026-88191: Microsoft Windows Search Component Elevation of Privilege Vulnerability
CVE-2026-96858: Windows Security Account Manager Tampering Vulnerability
CVE-2026-96911: Microsoft Windows Search Component Elevation of Privilege Vulnerability
CVE-2026-96929: Windows Kernel Elevation of Privilege Vulnerability
CVE-2026-96940: Microsoft Exchange Server Elevation of Privilege Vulnerability
CVE-2026-69452: Windows Enterprise App Management Elevation of Privilege Vulnerability
CVE-2026-69880: Desktop Window Manager Elevation of Privilege Vulnerability
CVE-2026-69918: Windows Core Messaging Elevation of Privilege Vulnerability
CVE-2026-70103: Windows Error Reporting Elevation of Privilege Vulnerability
CVE-2026-70106: Windows Kernel Elevation of Privilege Vulnerability
CVE-2026-70151: Windows Direct Composition Elevation of Privilege Vulnerability
CVE-2026-70176: Windows Win32k Elevation of Privilege Vulnerability
CVE-2026-70279: Microsoft Exchange Server Spoofing Vulnerability
CVE-2026-83785: Windows COM+ Event System Service Elevation of Privilege Vulnerability
CVE-2026-83927: Windows Registry Elevation of Privilege Vulnerability
CVE-2026-85884: Windows Health and Optimized Experiences Service Elevation of Privilege Vulnerability
CVE-2026-85902: Windows Direct Composition Elevation of Privilege Vulnerability
CVE-2026-85906: Windows Direct Composition Elevation of Privilege Vulnerability
CVE-2026-88093: Desktop Window Manager Elevation of Privilege Vulnerability
CVE-2026-96939: Servicing Stack Updates Elevation of Privilege Vulnerability
CVE-2026-97798: Windows Error Reporting Service Elevation of Privilege Vulnerability
CVE-2026-97799: Windows Audio Service Elevation of Privilege Vulnerability
CVE-2026-97800: Windows Mobile Broadband Elevation of Privilege Vulnerability
A complete list of all the other vulnerabilities Microsoft disclosed this month is available on its update page.
In response to these vulnerability disclosures, Talos is releasing a new Snort ruleset that detects attempts to exploit some of them. Please note that additional rules may be released at a future date, and current rules are subject to change pending additional information. Cisco Secure Firewall customers should use the latest update to their ruleset by updating their SRU. Open-source Snort Subscriber Ruleset customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.
Snort 2 rule coverage: 1:67210 - 1:67273, 1:67276 - 1:67279, 1:67282 - 1:67311, 1:67313 - 1:67316, 1:67319 - 1:67322
Snort 3 rule coverage: 1:301663 - 1:301694, 1:301696, 1:301702 - 1:301703, 1:301705 - 1:301706, 1:301709, 1:301711, 1:301717 - 1:301718