Microsoft Patches More Than 1,400 Security Flaws

1. Executive summary

Microsoft's October 2026 Patch Tuesday fixes more than 1,400 vulnerabilities across Windows, Office, .NET, Exchange, SharePoint and SQL Server, the second consecutive month to set a record. One flaw is confirmed exploited in the wild: CVE-2026-96951, a Windows Shell security feature bypass rated CVSS 8.8 HIGH, which is in CISA KEV (added 2026-10-13). A second flaw, CVE-2026-108398, a .NET Framework security feature bypass rated CVSS 8.8 HIGH, was publicly disclosed before the patch and is not in CISA KEV; EPSS for both is low (2% and 0% respectively), so volume rather than measured exploitation probability is the operational problem. For EMEA financial services the exposure is concentrated in unpatched Windows endpoints and servers, Exchange content-conversion paths, and .NET Framework application-control bypass on hosts where WDAC is the enforcement boundary. The immediate action is to patch the two CVSS 8.8 bypass flaws and the critical Exchange and AD DS remote code execution flaws ahead of the general batch.

2. Regulatory framing

No DORA Art. 18, 19, 28, 29 or 30 trigger and no NIS2 Art. 23 trigger is present in this item: the source reports a vendor patch release, not an incident at a client or a third-party provider failure.

3. Technical analysis & attack chain

This is a vendor patch cycle covering more than 1,400 CVEs. The table below prioritises the entries the sources describe in detail, ordered KEV first, then by the severity and exploitability the sources give. Only the two CVSS 8.8 bypass flaws get full mechanism depth; the remaining named flaws get their one row.

The verified reference data records CVE-2026-96951 as CWE-77 (Command Injection) and CVE-2026-108398 as CWE-426 (Untrusted Search Path). The sources describe both as security feature bypass flaws. Both classifications can describe the same defect: the bypass is the effect, and the injection or search-path weakness is the mechanism. The verified CWE values are the ones to use in any internal tracking.

Attack chain for CVE-2026-96951, the exploited flaw:

1. The attacker sends the target a malicious file by email or instant messaging. Tenable and SANS both describe social engineering as the delivery method.
2. The victim opens the file. SANS states the victim still has to open the file, so this is not a no-interaction exploit.
3. On opening, the file bypasses the Mark of the Web, the Windows control that tags files originating from the internet and warns the user before they run.
4. With MOTW bypassed, the file executes without the warning that would normally accompany a downloaded or externally sourced file.

Tenable notes this is the third Windows Shell flaw exploited in the wild in 2026, after CVE-2026-21510 (patched February 2026) and CVE-2026-32202 (patched April 2026). The same component has now been exploited three times in ten months.

Attack chain for CVE-2026-108398, the publicly disclosed flaw:

1. The attacker registers a malicious .NET assembly on the target system.
2. A protected process loads the assembly.
3. The load bypasses Windows Defender Application Control, which is the mechanism that restricts which binaries and code are permitted to run.
4. The attacker can then run unauthorised applications on the host.

Microsoft did not detect exploitation in the wild for CVE-2026-108398. The risk is that public disclosure before the patch gave attackers time to develop a working exploit, and the flaw is local rather than remote, so it requires the attacker to already have a foothold or an authorised user position on the host.

The remaining named flaws are described in the sources at headline level only. CVE-2026-70229 is an AD DS RCE triggered by a crafted packet, which places it on the network path to domain controllers. CVE-2026-70571 is an Exchange RCE triggered by a specific email during content conversion, which means it can be reached by anyone who can send mail to the server. CVE-2026-70279 is an Exchange spoofing flaw where successful exploitation against an administrative-privilege target allows access to or modification of organisational data. CVE-2026-92707 is a MessagePack-CSharp memory-exhaustion flaw where exposure depends on how a service uses the library to pack and unpack data. The Windows DHCP Server has ten RCE vulnerabilities, five critical, with no CVE numbers given in the sources.

Patch volume and component distribution. Tenable counts 1,407 CVEs (69 critical, 1,337 important, one low) across 301 products. SANS counts 1,417 (76 critical, seven requiring no customer action). SecurityWeek, The Hacker News and Malwarebytes all report 1,413. Krebs reports "more than 1,400" with at least 78 critical. The counts differ by source; the verified reference data does not resolve the total, so treat the exact figure as approximate and use the per-CVE data for prioritisation. The products with the most CVEs patched, per Tenable, are Microsoft Office Excel (69), DNS Server (52), Windows Kernel (46), Windows Installer (38), Windows Win32 Kernel Subsystem (36), Office SharePoint (34), Windows Search Component (29), Windows NTFS (26), .NET (25), and Office Word, SQL Server and Windows Error Reporting (22 each). Elevation of privilege accounts for 47.9% of the patched flaws and remote code execution for 22.3%.

Confidence caveats. The CVE-2026-96951 exploitation status is corroborated across Krebs, SecurityWeek, SANS, Tenable and Malwarebytes, and is confirmed by the CISA KEV entry in the verified reference data. The CVE-2026-108398 pre-patch public disclosure is corroborated across Krebs, SANS, Tenable and Malwarebytes. The component-level counts and the product ranking table are single-sourced to Tenable; verify against Microsoft's own advisory before using them for coverage reporting. The CVE-2026-92707 detail is single-sourced to Malwarebytes. The Windows DHCP Server RCE count is single-sourced to SANS and carries no CVE identifiers, so it cannot be actioned by CVE. No source in this corpus names a threat actor, a malware family, or an exploitation campaign behind CVE-2026-96951, and the verified reference data contains no MITRE ATT&CK profile for any actor in connection with this item. Any attribution of the in-the-wild exploitation to a named group is unconfirmed and should not be repeated.

4. Mitigation & containment

P1, within 24 hours:

• Patch CVE-2026-96951 on all Windows 10, Windows 11 and affected Server builds. This is the only flaw in the batch with confirmed in-the-wild exploitation and a CISA KEV entry. Apply the October 2026 cumulative update for the relevant build.
• Patch CVE-2026-108398 on all hosts running .NET Framework, prioritising any host where Windows Defender Application Control is the enforcement boundary for application execution. Public pre-patch disclosure makes this the second-highest priority despite the 0% EPSS.
• Patch CVE-2026-70571 and CVE-2026-70279 on all Exchange Server instances. CVE-2026-70571 is reachable by sending mail to the server, so an unpatched Exchange host is exposed to any sender who can reach it.
• Patch CVE-2026-70229 on domain controllers and any host running Active Directory Domain Services.
• If patching cannot complete inside 24 hours, block the delivery path for CVE-2026-96951 at the mail and messaging gateway: strip or quarantine inbound attachments of the file types your estate does not need, and treat MOTW-dependent warnings as unreliable on unpatched hosts until the update lands.

P2, within 72 hours:

• Patch the Windows DHCP Server RCE set. SANS reports ten RCE vulnerabilities with five critical and gives no CVE numbers, so work from Microsoft's October 2026 advisory for the DHCP Server component rather than from this note.
• Patch CVE-2026-92707 wherever MessagePack-CSharp is used to unpack data from untrusted sources. Exposure depends on how the service uses the library, so inventory the services first and patch the internet-facing ones first.
• Apply the Office updates. SANS flags the Office vulnerability count as noteworthy and recommends addressing the Office updates quickly. Excel alone accounts for 69 CVEs in Tenable's count.
• Apply the DNS Server updates. Tenable counts 52 CVEs against the DNS Server role.

P3, within 7 days:

• Complete the remaining batch across Windows Kernel, Windows Installer, Win32 Kernel Subsystem, SharePoint, Windows Search Component, NTFS, SQL Server and Windows Error Reporting.
• Confirm Windows 10 update coverage. Krebs reports Microsoft extended free Windows 10 updates to October 2027, so Windows 10 hosts remain in scope for this and future cycles. Any Windows 10 host not receiving updates is an unmanaged exposure.
• Reconcile your deployed build numbers against Microsoft's October 2026 release notes for each product, because the total CVE count differs between sources and no single figure in this corpus is authoritative.

5. Indicators of compromise

No indicators of compromise available in the source material. The sources name vulnerabilities and affected components but give no hashes, domains, IP addresses, file paths, registry keys or command lines.

Behavioural indicators:

6. Detection

The sources give no file hashes, mutex names, scheduled-task names, service names, registry keys or command-line flags for any of the flaws in this batch. The artefacts available are the affected component names and the behavioural mechanisms. A YARA rule built on component names would detect reporting about the vulnerabilities rather than the vulnerabilities themselves, so no YARA rule is emitted here.

A Sigma rule is possible for the WDAC bypass behaviour, which is the one mechanism in this batch with a log-observable signature: a .NET assembly load by a protected process on a host where application control is enforced.

title: .NET Assembly Load by Protected Process on WDAC-Enforced Host
id: 7f3c1a92-4d6e-4b21-9c88-2a5e0f1b6d34
status: experimental
description: Detects a .NET assembly load by a protected process, the mechanism described for CVE-2026-108398, a .NET Framework security feature bypass that allows Windows Defender Application Control to be bypassed. Tune to your WDAC-enforced population before enabling.
author: Adverse Trace
date: 2026-10-14
references:

  - https://www.tenable.com/blog/microsofts-october-2026-patch-tuesday-addresses-1407-cves-cve-2026-96951
  - https://www.malwarebytes.com/blog/bugs/2026/10/update-windows-record-patch-tuesday-fixes-flaw-already-under-attack
logsource:
  product: windows
  category: image_load
detection:
  selection_image:
    Image|endswith:

      - '\MsMpEng.exe'
      - '\csrss.exe'
      - '\services.exe'
      - '\lsass.exe'
      - '\svchost.exe'
  selection_module:
    ImageLoaded|endswith: '.dll'
    Description|contains: '.NET'
  condition: selection_image and selection_module
falsepositives:

  - Legitimate .NET assemblies loaded by protected processes on hosts where WDAC is not enforced
  - Software deployment and management agents that register assemblies during installation
level: medium

The rule above is a starting point, not a finished detection. The sources do not give the specific assembly path, the protected process name, or the WDAC event IDs involved, so the rule keys on the general shape of the behaviour and will need tuning against your own WDAC-enforced population. Enable WDAC audit mode first if you are not already collecting application control events.

CVE assessment

2 referenced CVEs — 1 actively exploited (CISA KEV)

7. Sources

• Krebs on Security, "Microsoft Patches More Than 1,400 Security Flaws", https://krebsonsecurity.com/2026/10/microsoft-patches-more-than-1400-security-flaws/, 2026-10-13
• SecurityWeek, "Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day", https://www.securityweek.com/microsoft-patches-record-1413-vulnerabilities-including-exploited-windows-zero-day/, 2026-10-13
• SANS Internet Storm Center, "October 2026 Microsoft Patch Tuesday", https://isc.sans.edu/diary/rss/33422, 2026-10-13
• Tenable Research, "Microsoft's October 2026 Patch Tuesday addresses 1407 CVEs (CVE-2026-96951)", https://www.tenable.com/blog/microsofts-october-2026-patch-tuesday-addresses-1407-cves-cve-2026-96951, 2026-10-13
• The Hacker News, "Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug", https://thehackernews.com/2026/10/microsoft-patches-record-1413-flaws.html, 2026-10-13
• Malwarebytes Labs, "Update Windows: Record Patch Tuesday fixes flaw already under attack", https://www.malwarebytes.com/blog/bugs/2026/10/update-windows-record-patch-tuesday-fixes-flaw-already-under-attack, 2026-10-13
• Krebs on Security, "Microsoft Patches a Record 570 Security Flaws", https://krebsonsecurity.com/2026/07/microsoft-patches-a-record-570-security-flaws/, 2026-07 (background on patch volume trend)

8. Adverse Trace position

Adverse Trace assesses CVE-2026-96951 as the priority item in this batch: CVSS 8.8 HIGH, confirmed in CISA KEV since 2026-10-13, and the third Windows Shell flaw exploited in the wild in 2026. CVE-2026-108398 is the second priority on the strength of pre-patch public disclosure and its WDAC bypass effect, not on measured exploitation, which the 0% EPSS reflects. The remaining flaws are high-volume but individually unremarkable, and the operational risk to EMEA financial services clients is capacity: more than 1,400 CVEs against 301 products in one cycle, with 69 to 78 critical depending on the count used, cannot be regression-tested and deployed in a normal window. Clients that treat this as a routine Patch Tuesday will not reach the two flaws that matter inside the window that matters. We will track Microsoft's advisory for the Windows DHCP Server RCE set, which SANS reports without CVE identifiers and which we cannot currently map to a patch, and we will update this note if Microsoft confirms exploitation of CVE-2026-108398 or if a threat actor is linked to the CVE-2026-96951 exploitation. No actor attribution is available in the source material and we are not making one.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.