)
)
September's 973 CVEs held the record for one month. Microsoft's October release includes 1,408 CVEs, about 45% more, with 78 rated Critical, 108 assessed Exploitation More Likely, one confirmed exploited, and one publicly disclosed. Big months are the new normal.
Three bugs stand out because each one beats a defense you'd expect to hold. A Windows Shell flaw strips the tag that triggers every internet-file warning on the endpoint. For the second month running, an Outlook bug executes code from the Reading Pane before anyone opens the message. And a publicly disclosed .NET Framework flaw gets code past Windows Defender Application Control.
Two of the three are rated Important. Don't sort by the label. Sort by exploitation status and by what the attacker gets. For a deeper dive, check out the Patch [Fix] Tuesday podcast.
CVE-2026-96951 [Exploited]
Windows Shell security feature bypass vulnerability
CVE-2026-96951 (CVSS 8.8/10) is rated Important, and Microsoft confirms attackers are already using it. That second fact sets its place in the queue. Exploitation status outranks the CVSS score, the severity label, and everything else in triage.
The bug targets Mark of the Web (MOTW). When Windows saves a file from the internet, it writes a hidden tag in an NTFS alternate data stream called Zone.Identifier. A ZoneId of 3 means the internet. A ZoneId of 4 means restricted sites. The tag only exists on NTFS volumes.
MOTW is a tag, not a protection. The protections are the controls that read it: SmartScreen, Office Protected View, the Office block on internet macros (on by default since 2022 for Word, Excel, PowerPoint, and Visio on Windows), Smart App Control on Windows 11, and the Attachment Manager prompt. MOTW is like the sticker on a package in that every guard in the building checks the sticker, not the package. This bug delivers the package without one.
The result is a file that opens as though the user created it locally. No warning dialog, no read-only view, no macro block. One bug turns off several controls at once.
User interaction is required, and that's no comfort. Attackers already own the phishing infrastructure: the lures, the fake invoices, and now AI tooling that writes and sends them at scale. Somebody always double-clicks. What attackers can't always get is a run with no warning in front of it. This bug supplies exactly that.
Microsoft credits Anthropic's Claude as part of the discovery, another sign that AI-assisted vulnerability research is now routine. Anyone running a vulnerability disclosure program has seen the report volume climb.
How attackers may exploit this vulnerability
An attacker sends a crafted file by email, chat, or any other channel that reaches a user. The user opens it, and it runs without SmartScreen, Protected View, or a macro block in the way.
Microsoft hasn't named the file type. Past Windows Shell and MOTW bypasses leaned on shortcuts (.lnk and .url files) and archives, and CVE-2026-21510 in February was widely reported as shortcut based.
What to look out for
User workstations that receive external email and chat. Teams and Slack workspaces with external guests give attackers another way in.
Shortcut and archive files arriving from outside the organization, especially ones that open without the prompts users usually see.
Mitigation guidance
Patch it first. Exploited outranks Important.
Verify installation by OS build number, not by a deployment that reports success.
Keep shipping the full monthly cumulative update even when an advisory looks quiet. The Copy2Pwn MOTW bypass, CVE-2024-38213, was fixed in June 2024 and not disclosed until August. Endpoints that skipped June stayed exposed with no advisory telling them so.
Send endpoint logs to your SIEM and alert on suspicious child processes from Explorer and Office. Good detection catches the technique before the advisory names it.
CVE-2026-70242 [Critical]
Microsoft Office Outlook remote code execution vulnerability
CVE-2026-70242 (CVSS 9.8/10) is September's Outlook story again. A crafted email triggers a heap-based buffer overflow when Outlook shows it in the Reading Pane. The recipient doesn't open the message or click anything. No authentication, no user interaction.
This is the second month in a row Microsoft has fixed a Reading Pane remote code execution bug in Outlook. September's was CVE-2026-78509. The pattern isn't new either. Preview-pane bugs surface every few years, and they draw attention because email is the front door. Addresses are easy to find in breach dumps and on company websites, so targeting costs an attacker almost nothing.
They also break the advice users have been given for years. Security training says don't click suspicious links. Previewing feels safe, and with this bug it isn't.
Microsoft rates exploitation Less Likely, doesn't explain the rating, and reports no exploitation so far. The finder reported it anonymously. With a zero-interaction trigger, "less likely" isn't a reason to wait.
How attackers may exploit this vulnerability
An attacker sends a crafted email to a user running an affected Outlook build.
Outlook renders the message in the Reading Pane, and the overflow executes code. No open, no click, no attachment.
What to look out for
Office installations that lag the current security build while the same endpoints report fully patched on Windows. Microsoft 365 Apps updates arrive from the Office CDN on their own schedule, not through Windows Update.
Office LTSC 2021 installations. Office LTSC 2021 reaches end of support on October 13, 2026, so plan the move off it after this update lands.
Mitigation guidance
Patch Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024, then verify the installed Office build directly. Windows patch status doesn't report it.
Add hardening while the update rolls out. Use Group Policy to block automatic picture downloads and render mail as plain text, which removes much of what a crafted message relies on. Some organizations turn off the Reading Pane entirely.
Stop what you can at the gateway. An email security and phishing protection layer keeps more crafted messages out of the inbox in the first place.
CVE-2026-108398 [Important]
.NET Framework security feature bypass vulnerability
CVE-2026-108398 (CVSS 8.8/10) is October's only publicly disclosed CVE: Microsoft lists its details as public before the fix shipped. It needs local access and a low-privilege account, and Microsoft assesses it Exploitation Less Likely, so it ranks behind the exploited Shell bypass.
The flaw is an untrusted search path in .NET Framework. An attacker places a crafted .NET assembly on the endpoint and registers it to load in a protected process, then runs code inside that process without tripping Windows Defender Application Control (WDAC). No user interaction is needed. If WDAC is how you keep unapproved software off your endpoints, this bug walks around it.
Microsoft lists affected .NET Framework versions from 3.5 through 4.8.1 on Windows 10, Windows 11, and Windows Server 2012 through 2025.
Patch regularly, patch often
All three bugs this month share a lesson: the signal you'd normally trust is the wrong one. A severity label of Important hides a bug attackers are already using. A "deployment succeeded" status hides an Office build that never updated. A quiet advisory hides a fix that won't be disclosed for two months. The only reliable answer is knowing what's actually installed, endpoint by endpoint.
Patch the exploited Shell bypass first. Verify Office separately. Ship the full cumulative update every month.
Big releases are the baseline now. The teams that already know what's on every endpoint will work through this month's list in days. The ones still asking that question will spend the month finding out.
Sources
Microsoft Security Response Center – October 2026 Security Updates – Full list of October 2026 Patch Tuesday advisories, CVSS scores, and exploitation status
CISA – Known Exploited Vulnerabilities Catalog – Authoritative tracker for actively exploited CVEs
Microsoft – Macros from the internet are blocked by default in Office – How Office uses Mark of the Web to block internet macros
Microsoft – Overview of the update process for Microsoft 365 Apps – Office CDN delivery, update channels, and installation deadlines
Microsoft – Office LTSC 2021 lifecycle – End-of-support date for Office LTSC 2021
)
)
)