Microsoft Patch Tuesday – October 2026

⚡ TL;DR | Go Straight to the October 2026 Patch Tuesday Audit Report

Patch Tuesday is once again upon us. As always, our team has put together the monthly Patch Tuesday Report to help you manage your update progress. The audit report gives you a quick and clear overview of your Windows machines and their patching status. The October 2026 edition of Patch Tuesday brings us 1410 fixes, with 70 rated as critical. We’ve listed the most important changes below.

Windows Shell Security Feature Bypass Vulnerability

CVE-2026-96951 is a security feature bypass in Windows Shell caused by a command injection flaw, where special elements in a command aren’t properly neutralized. An attacker who exploits it can evade Mark of the Web (MOTW) protections, which means a downloaded or emailed file no longer gets the extra warnings and restrictions Windows normally applies to content from the internet.

Exploitation happens over the network and requires no privileges, but it does need the user to play along. The typical scenario is a specially crafted file sent by email or instant message, or a link to an attacker-controlled site. The flaw carries a CVSS score of 8.8 and affects every supported version of Windows client and server.

This is the only vulnerability this month that Microsoft has confirmed as actively exploited in the wild. It was not publicly disclosed before the fix, but with attacks already happening, this one belongs at the top of your patching list.

Microsoft Exchange Server Remote Code Execution and Spoofing Vulnerabilities

CVE-2026-70571 is a critical remote code execution flaw in Exchange Server caused by a stack-based buffer overflow. An unauthenticated attacker can send a specially crafted email to an affected server, which triggers an internal content-conversion process and can lead to code execution on the server itself. No user interaction is needed. Microsoft rates the attack complexity as high, since the attacker needs a solid understanding of the target environment and success isn’t guaranteed.

CVE-2026-70279 is a cross-site scripting issue in Exchange Server that allows spoofing over the network. An attacker sends a crafted link and convinces a user to click it, after which malicious script runs in the victim’s browser. If that user happens to be an Exchange admin, the attacker can act with their privileges and access or modify organizational data. It scores a CVSS of 9.3 thanks to the scope change.

Both are rated “Exploitation More Likely”, neither is publicly disclosed or exploited yet, and they affect Exchange Server 2016 CU23, 2019 CU14 and CU15, and Subscription Edition. Exchange making the highlight reel again will surprise exactly nobody, but an unauthenticated, email-triggered RCE on an internet-facing server is a good reason not to let this one sit.

Windows Active Directory Domain Services Remote Code Execution Vulnerability

CVE-2026-70229 is a critical remote code execution vulnerability in Active Directory Domain Services caused by incorrect authorization. An unauthenticated attacker can send a specially crafted packet to the affected service over the network and execute code on the target system, with no authentication or user interaction required.

Microsoft rates the attack complexity as high: exploitation depends on specific network configurations and timing conditions, so it won’t work reliably in every environment. That said, the target here is your domain controllers, and code execution on a DC is about as bad as it gets. The flaw has a CVSS score of 8.1, is rated “Exploitation More Likely”, and was not publicly disclosed or exploited at release.

Run the Patch Tuesday October 2026 Audit

To help manage your update progress, we’ve created the Patch Tuesday Audit that checks if the assets in your network are on the latest patch updates. The report has been color-coded to see which machines are up-to-date and which ones still need to be updated. As always, system administrators are urged to update their environment as soon as possible to ensure all endpoints are secured.

The Lansweeper Patch Tuesday dashboard is available in our marketplace and is automatically kept up-to-date. Lansweeper Sites is included in all our licenses without any additional cost and allows you to federate all your installations into one single view so all you need to do is look at one dashboard, automatically updated.