Patch Tuesday im Oktober 2026: 1.413 CVEs, 1 ausgenutzter Zero-Day

Microsoft’s October 2026 Patch Tuesday release addresses 1,413 Microsoft CVEs, setting a new record just one month after September’s previous high of 974. That’s roughly a 45% increase month over month. The release spans Windows, Microsoft 365 and Office apps, SharePoint Server, SQL Server, Exchange Server, Azure, Defender, and developer tools. Microsoft is also republishing one non-Microsoft CVE.

One vulnerability is already under active exploitation: CVE-2026-96951, a security feature bypass in Windows Shell. A second, CVE-2026-108398 in the .NET Framework, has been publicly disclosed, so technical details are already available even though Microsoft has not yet observed attacks. Both are rated Important, which reinforces why exploit status should take priority over severity labels alone.

With more than 1,400 Microsoft CVEs to evaluate, IT teams need a risk-based rollout that starts with the vulnerabilities attackers are most likely to use and the systems where a compromise would do the most damage.

Microsoft patch breakdown for October 2026

Of the 1,408 CVEs with severity ratings, Microsoft rated 78 Critical, 1,329 Important, and 1 Moderate. All 1,408 require customer action in the form of an update to install.

Elevation of privilege and remote code execution account for roughly 70% of the release:

Elevation-of-privilege flaws can turn limited access into full control of a system, and remote code execution flaws can provide that initial access. With nearly 1,000 of these two types in a single release, IT teams need to know which affected systems are exposed and which hold privileged access.

Where the vulnerabilities are concentrated

Windows accounts for more than three-quarters of this month’s CVEs. Office and SharePoint Server together add another 170, and developer tools account for 61 across 60 separate updates.

Microsoft’s published figures for this release differ slightly: the release notes state 1,413 CVEs, the product family breakdown totals 1,414, and the published CVE list contains 1,411. This post uses 1,413, the figure in Microsoft’s release notes.

One exploited zero-day and one publicly disclosed vulnerability

Microsoft has flagged two CVEs with special exploitability designations this month. Both are security feature bypass vulnerabilities rated Important.

Security feature bypass vulnerabilities rarely complete an attack on their own. They usually work alongside another flaw, such as remote code execution or elevation of privilege, by removing a safeguard that would otherwise block or warn about the next step. Patching them closes off a step attackers may already be using.

CVE-2026-96951 should be patched on every Windows endpoint first, regardless of its Important rating. With Mark of the Web bypassed, a malicious file sent by email or chat can open without the warnings users normally see. The user still has to open the file, so this flaw pairs naturally with phishing and with the file-based vulnerabilities covered later in this post.

CVE-2026-108398 has not been exploited, but because it was publicly disclosed, technical details are already available. That raises the odds of exploitation. An attacker needs an account on the system first, so this update is especially important for organizations that rely on Windows Defender Application Control or similar allowlisting to contain an intruder who already has a foothold.

Neither CVE appears in CISA’s Known Exploited Vulnerabilities catalog as of publication. Additions often follow within days of a designation like this, so check the catalog as you plan your rollout.

Critical vulnerabilities to prioritize next

Microsoft rated 78 vulnerabilities Critical this month. Sixty-five are remote code execution vulnerabilities, and the remaining 13 are elevation of privilege or spoofing. Rather than treating them as one group, prioritize them by the affected infrastructure, how exposed it is, and what a compromise would put at risk.

Windows DHCP and network-facing services

Five Critical remote code execution vulnerabilities affect Windows DHCP Server:

• CVE-2026-96934

• CVE-2026-88117

• CVE-2026-88120

• CVE-2026-88119

• CVE-2026-88171

DHCP Server is commonly reachable across internal network segments, which makes it a frequent pivot point for network-wide compromise. The release also includes a Critical remote code execution vulnerability in the DHCP Client (CVE-2026-70250).

Several other network-facing services carry Critical remote code execution vulnerabilities this month:

QUIC underpins HTTP/3 and other network transport, so these flaws matter most on internet-facing Windows Server workloads. Remote Desktop Gateway sits at the edge of many remote access deployments. Identify where these services are enabled, and move externally reachable systems to the front of the queue.

Identity and certificate infrastructure

Critical vulnerabilities also affect the services that control authentication, federation, and certificate enrollment:

Each appears only once in the release, but each affects a high-value target. A compromised domain controller or certificate enrollment service can give an attacker reach across the whole environment. AD FS spoofing can undermine the federated single sign-on trust many organizations depend on. Domain controllers, AD FS servers, and NDES servers should be among the first servers evaluated after the exploited zero-day.

Exchange Server and deployment infrastructure

Exchange Server (CVE-2026-70571) and Windows Deployment Services (CVE-2026-88174) each have a Critical remote code execution vulnerability. SharePoint Server has a Critical elevation-of-privilege vulnerability (CVE-2026-102866).

Exchange and SharePoint often hold sensitive business data and connect to other internal resources. Deployment Services can affect every endpoint that relies on it for imaging or provisioning. Prioritize deployments with external exposure or access to high-value data.

Hyper-V and VBS Enclave

This month’s updates include host-level code execution in Hyper-V and Critical elevation-of-privilege flaws in Windows Virtualization-Based Security (VBS) Enclave and core kernel components.

Hyper-V hosts often support production workloads with strict availability requirements. Use staged testing and coordinated maintenance windows where an immediate rollout could disrupt services, but don’t let those windows delay host-level patches for long.

Microsoft 365 and Office applications

Office applications account for 34 of this month’s Critical remote code execution vulnerabilities:

Excel stands out, with an unusually large concentration of Critical flaws in a single app. Malicious documents remain one of the most common phishing-driven paths into user environments. That risk is higher this month because the exploited Mark of the Web bypass can strip the warnings users would normally see on downloaded files. Visio is often lower on patch-priority lists than Word, Excel, or Outlook, but it carries the same document-based risk.

Media, graphics, and printer drivers

Ten Critical remote code execution vulnerabilities affect media, graphics, and document-rendering components, including Media Foundation, GDI+, Codecs, Windows PDF, Text Shaping, and Raw Image Extension (CVE-2026-96202 and CVE-2026-96943). These can be triggered by opening a crafted image, video, font, or PDF, without macros or scripting.

The PostScript Printer Driver also has three Critical remote code execution vulnerabilities: CVE-2026-70153, CVE-2026-70147, and CVE-2026-108467. Printer drivers are widely deployed and easy to overlook in patch cycles, so confirm they’re covered by the same rollout as the rest of the release.

How to prioritize October 2026 patches

No fixed timeline fits every environment. Use these tiers as a starting point, then adjust for exposure, business impact, and testing requirements.

Patch within 72 hours

• CVE-2026-96951 (Windows Shell) on every Windows endpoint, followed by CVE-2026-108398 (.NET Framework)

• Windows DHCP Server and DHCP Client

• Remote Desktop Gateway, NDES, and Active Directory Domain Services

• Microsoft QUIC on internet-facing Windows Server workloads

• Exchange Server and SQL Server, starting with externally reachable systems or systems holding sensitive data

• Hyper-V hosts

• Any CVE later added to the CISA KEV catalog or flagged as Exploitation More Likely

Patch within 1 to 2 weeks

• Office applications, starting with Excel, then Outlook, PowerPoint, Word, and Visio

• Kernel and VBS Enclave elevation-of-privilege vulnerabilities

• Media, graphics, and document-rendering components, plus the PostScript Printer Driver

• Visual Studio, Visual Studio Code, and .NET on developer workstations

• Azure and Entra elevation-of-privilege vulnerabilities

Exposure should still override the default timeline. Users who routinely open external documents may need Office updates sooner.

Regular patch cycle

• Important-rated elevation-of-privilege and information disclosure vulnerabilities in components with limited exposure

• Local-access-only and device driver issues on systems with restricted physical access

• Non-internet-facing systems with compensating controls in place

Notable third-party updates

Microsoft is republishing just one non-Microsoft CVE this month, down from 25 in September: CVE-2026-21413, a Raw Image Extension remote code execution vulnerability credited to Cisco Talos. It affects the same component as the two Microsoft-owned Critical Raw Image Extension flaws covered above (CVE-2026-96202 and CVE-2026-96943), so all three can be handled as a single remediation effort.

Microsoft Edge shipped no new CVEs in this release. Teams should still confirm browser, developer tool, and third-party application updates on their own schedules and keep them in the same vulnerability-management workflow as operating system updates. Separate processes can leave blind spots even when Windows patching is current.

Why October Patch Tuesday matters for IT teams

October’s release raises two operational issues that go beyond any individual CVE.

1. Record volume makes manual triage unrealistic

This is the second record-setting release in a row, and the jump from 974 to 1,413 CVEs in one month leaves little room for manual review. Teams need to know quickly which devices run affected software, which vulnerabilities are being exploited, and which systems support identity, remote access, or critical workloads. That depends on accurate hardware and software inventory.

Microsoft is responding to the volume as well. With this release, it introduced risk cohorts, an experimental way of grouping related CVEs around shared exposure questions, such as which systems process untrusted files. Microsoft notes that cohorts don’t rank danger, so exploitation status and exposure should still set the order of work.

2. Some systems just received their last security update

October’s update is the final security update for Windows 11 version 24H2 Home and Pro and for Windows 10 Enterprise LTSB 2016. Windows 11 version 23H2 Enterprise, Education, and IoT Enterprise reach end of updates in November. Devices running these editions stop receiving fixes after their end date, no matter how quickly a team patches. Identify them now and plan upgrades, because this month’s zero-day fix may be the last protection they get.

How Splashtop AEM can help prioritize and deploy patches

A 1,413-CVE release with an exploited zero-day gives IT teams two jobs: finding what matters in their environment and deploying the right updates quickly. Splashtop AEM (Autonomous Endpoint Management) handles both from a centralized console.

• Find exposed devices: Splashtop AEM continuously scans Windows and macOS endpoints for CVEs, including vulnerabilities in CISA’s Known Exploited Vulnerabilities catalog, alongside patch status and hardware and software inventory.

• Prioritize what attackers are using: AI-powered CVE summaries and risk signals help teams move vulnerabilities like CVE-2026-96951 ahead of the rest of the release.

• Deploy and verify faster: Real-time OS and third-party application patching, automated policies, maintenance windows, and update rings let teams test Office or server updates on a smaller group of devices first. Teams can then expand the rollout and track which installs succeeded or failed.

• Strengthen existing workflows: Splashtop AEM can enhance Microsoft Intune by adding real-time patching, CVE visibility, and remediation. Teams using an RMM can use it to fill gaps in patch visibility and automation.

Stay ahead of record Patch Tuesday volume with Splashtop AEM

October’s release shows how quickly patch management becomes a triage problem. With 1,413 CVEs and an exploited zero-day in the mix, IT teams need to find exposed devices, deploy the most urgent updates first, and confirm every endpoint is covered.

Start a free trial of Splashtop AEM to see which endpoints are vulnerable, prioritize high-risk updates, and deploy patches faster.