Zero-Days Lurk in Microsoft's Overgrown October Patch Tuesday

Microsoft’s October 2026 Patch Tuesday update addressed 1,413 Microsoft CVEs, making it the largest security update described in the article. It included 80 critical vulnerabilities and two zero-days. One of those zero-days was under active exploitation. The update covered Windows, Office, Developer Tools, SharePoint Server, SQL Server, Exchange Server, Azure, Defender, and other products.

Windows accounted for 1,102 vulnerabilities. The active zero-day, CVE-2026-96951, affected Windows Shell and bypassed Mark of the Web protections. That could also defeat SmartScreen, Office Protected View, macro blocking, Smart App Control, and Attachment Manager warnings. CVE-2026-108398 affected .NET Framework and could let attackers run code inside a protected process.

Security experts urged teams to focus on exploitable risk rather than the headline count. They highlighted flaws that are actively exploited, remotely reachable, unauthenticated, or able to bypass important defenses. Microsoft also republished Cisco Talos’s CVE-2026-21413 raw image extension RCE.

A zero-day vulnerability is a software weakness that attackers can exploit before defenders have had a reliable fix or enough time to deploy one. The term signals that defenders have had little or no warning. That makes the vulnerability especially urgent when exploitation is already happening. Attackers may be using it while many systems remain unpatched.

In Microsoft’s October update, CVE-2026-96951 was the actively exploited zero-day. It affected Windows Shell and targeted the Mark of the Web tag attached to files downloaded from the Internet. Attackers could craft files that bypassed the tag and several protections that trust it, including SmartScreen and Office Protected View.

The article contrasts this with CVE-2026-108398, another zero-day that Microsoft rated “exploitation less likely.” It required local access and a low-privilege account. Teams should therefore prioritize the actively exploited flaw, deploy the applicable update quickly, and monitor unpatched systems for suspicious activity.

Microsoft’s October 2026 update addressed 1,413 CVEs, which the article describes as the largest security update ever. It included 80 critical flaws and two zero-days. Windows made up most of the total, with 1,102 vulnerabilities. Other affected areas included Office, Developer Tools, SharePoint Server, SQL Server, Exchange Server, Azure, Defender, and other categories.

September’s update had addressed 974 CVEs, a number that already appeared staggering. October therefore added 439 more listed vulnerabilities than the previous month. The scale can be useful for understanding workload, but it does not show which flaws create the greatest danger. A long list may include many weaknesses that are difficult to exploit or unlikely to be used.

Security experts advised teams not to treat the total as the main priority signal. Tyler Reguly said that meaningful figures include the 26 Microsoft CVEs from 2026 that appeared in CISA’s Known Exploited Vulnerabilities catalog. Teams should combine patching with risk-based assessment, suitable tools, and prepared processes.

Mark of the Web, or MOTW, is a tag Windows applies to files downloaded from the Internet. It helps classify those files and triggers security checks that warn users or restrict risky behavior. If attackers bypass MOTW, the file may avoid several safeguards that depend on the tag. That turns an ordinary download into a much more dangerous delivery method.

The actively exploited Windows Shell flaw, CVE-2026-96951, lets attackers craft files that arrive without the MOTW tag. The article compares MOTW to a package sticker checked by guards. Without the sticker, the file can open as though the user created it locally. SmartScreen, Office Protected View, Office macro blocking, Smart App Control, and the Attachment Manager prompt may all be bypassed.

The result could be silent execution of malicious content and fewer opportunities for a user or security tool to stop it. Automox researchers said the flaw turns off several controls at once. Because exploitation was active, the article emphasizes urgent deployment of Microsoft’s applicable update and attention to unpatched systems.

An Outlook Reading Pane vulnerability is dangerous because the message can be processed when Outlook displays its preview. Users may not realize that merely receiving or viewing a message preview can expose them to exploitation. Removing the need to open an email or click a link lowers the attacker’s effort and reduces the user actions defenders often rely on as a safety barrier.

The article identifies CVE-2026-70242 as a critical Outlook remote code execution vulnerability with a CVSS score of 9.8. An attacker could craft an email that triggers a heap-based buffer overflow when Outlook shows it in the Reading Pane. The attack required no authentication and no interaction beyond the message being displayed in the pane.

Automox researchers called email the “front door” because addresses are easy to find in breach dumps and on company websites. That makes targeting inexpensive. The flaw was one of the October vulnerabilities researchers flagged for priority attention, alongside the actively exploited Mark of the Web bypass. Patching Outlook reduces exposure before crafted messages reach users.

Security teams prioritize exploited, remotely reachable, and unauthenticated vulnerabilities because those characteristics can make attacks easier to launch and harder to contain. A flaw that attackers are already using presents immediate evidence of danger. A remotely reachable flaw can expose systems without physical access. A vulnerability needing no authentication removes another barrier.

The article gives two examples. CVE-2026-96951 was under active exploitation and bypassed Mark of the Web protections, weakening several controls at once. CVE-2026-70242 in Outlook could be triggered through a crafted email shown in the Reading Pane, without authentication or user interaction. Those properties make both flaws more urgent than many obscure or difficult-to-reach bugs.

Tyler Reguly argued that raw vulnerability totals are not meaningful by themselves. He noted that only 26 Microsoft CVEs from 2026 had appeared in CISA’s Known Exploited Vulnerabilities catalog, less than 1% of Microsoft’s 2026 fixes. Teams still need broad patching, but risk-based tools, processes, and people help identify what requires immediate action.

A CVE, or Common Vulnerabilities and Exposures entry, identifies a specific publicly recognized vulnerability in software or hardware. The identifier gives defenders, vendors, and researchers a shared reference. A CVE is not automatically an active attack. Its practical danger depends on factors such as exploitability, access requirements, authentication, user interaction, and whether attackers are using it.

Microsoft’s update lists examples including CVE-2026-96951, which bypassed Mark of the Web protections, and CVE-2026-70242, which could remotely execute code through an Outlook Reading Pane message. Such weaknesses can undermine defenses or let attackers run code. Other outcomes mentioned include exposed business information, weakened endpoint defenses, and disrupted operations.

Security patches are designed to correct the underlying software weakness or strengthen the affected control. Applying them reduces the available attack path, but risk remains on systems that are unpatched. The article therefore emphasizes processes, tools, and people that help teams assess exposure, prioritize exploited or reachable flaws, deploy updates, and monitor systems awaiting fixes.