Roundup of Microsoft Patch Tuesday (October 2026)

Summary

On October 14 (UTC+8), 2026, Microsoft released its October 2026 Security Updates, which included patches for a total of 1,413 CVEs, an increase of 439 CVEs compared to the previous month.

Figure 1 Vulnerabilities Patched by Microsoft in the Last 12 Months

Over the past year, the number of patches released by Microsoft each month has shown an overall upward trend, despite some fluctuations, reaching a one-year high this month.

This month's update addresses multiple high-severity vulnerabilities involving remote code execution, privilege escalation, and other attack scenarios. Some of these vulnerabilities can be exploited remotely without authentication. Given the potential impact, users are advised to promptly assess their affected assets and apply relevant security patches as soon as possible.

The following vulnerabilities pose relatively high risks and are recommended for prioritized remediation.

Details of Key Vulnerabilities

Analysis

Windows Shell Security Feature Bypass Vulnerability (CVE-2026-96951)

Windows Shell is the core command-line and script execution environment in the Windows operating system. It handles command invocation and script parsing initiated by users and applications, and is a key component for routine system operations and maintenance (O&M) and automated task execution.

A security feature bypass vulnerability exists in Windows Shell. The vulnerability stems from improper neutralization of special elements when Windows Shell processes command input. As a result, an unauthenticated attacker can bypass system security restrictions over a network, and then perform unauthorized operations on the target system. This vulnerability has been exploited in the wild. After assessment, this vulnerability is considered critical in terms of the threat level. We recommend that users promptly apply the Microsoft security patches.

.NET Framework Security Feature Bypass Vulnerability (CVE-2026-108398)

.NET Framework is an application framework developed by Microsoft that provides a unified programming model and runtime environment for software running on the Windows platform. It serves as a key foundation for the development and deployment of enterprise applications.

A security feature bypass vulnerability exists in .NET Framework. The vulnerability stems from an untrusted search path issue. When loading components such as dynamic-link libraries (DLLs), the program does not strictly validate file paths, potentially allowing an attacker to place a malicious DLL in a higher-priority search location and hijack the execution flow of a legitimate program. An attacker who has already obtained local access to the system can exploit this vulnerability to bypass application security restrictions and execute arbitrary code within the security context of the affected application. This may lead to privilege escalation or the disclosure of sensitive information. After assessment, this vulnerability is considered critical in terms of the threat level. We recommend that users promptly apply the Microsoft security patches.

Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2026-70571)

Microsoft Exchange Server is an enterprise email and collaboration platform that handles core services, such as email transmission and reception, calendar sharing, and contact management. It serves as critical communications infrastructure for the daily operations of many organizations.

A remote code execution vulnerability exists in Microsoft Exchange Server. The vulnerability stems from a stack-based buffer overflow in the processing of email content conversion. An unauthenticated attacker can trigger the internal content conversion process by sending a specially crafted email, thereby achieving code execution. Exploitation of this vulnerability does not require user interaction. After assessment, this vulnerability is considered critical in terms of the threat level. We recommend that users promptly apply the Microsoft security patches.

Windows Active Directory Domain Services Remote Code Execution Vulnerability (CVE-2026-70229)

Active Directory Domain Services (AD DS) is a core directory service component in Windows Server. It centrally manages user identities, permissions, and resource access across a network, and serves as the central system for authentication and authorization in enterprise domain environments.

A remote code execution vulnerability exists in AD DS. The vulnerability stems from a flaw in the authorization validation mechanism. An unauthenticated attacker can exploit this vulnerability by sending specially crafted network packets to execute arbitrary code on an affected system. Exploitation of this vulnerability requires neither credentials nor user interaction. Successful exploitation can result in complete compromise of a domain controller. After assessment, this vulnerability is considered critical in terms of the threat level. We recommend that users promptly apply the Microsoft security patches.

Affected Versions

Official Solution

Microsoft has released security patches for affected software. Affected users can apply the corresponding security patches based on their system versions.

Download links:

1. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951
2. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108398
3. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70571
4. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70229

References

https://msrc.microsoft.com/update-guide/releaseNote/2026-Oct

Timeline

On October 14, 2026, Microsoft released a security bulletin.

On October 14, 2026, Sangfor FarSight Labs released a vulnerability alert.

Sangfor Farsight Labs is dedicated to tracking and analyzing global advanced threat landscapes. By leveraging its robust automated attribution and external monitoring systems, the lab delivers rapid, precise analysis and cross-correlation of APT attack samples. Having archived comprehensive profiles on dozens of APT and cybercrime entities, Farsight Labs has a proven track record of helping clients successfully mitigate high-stakes APT and cybercriminal incidents through expert incident response. In an era of escalating security conflicts and evolving TTPs, Sangfor’s Advanced Threat Team is committed to continuous vigilance and the rigorous research of new global security threats to ensure proactive defense.