October 2026 Patch Tuesday: 1,413 CVEs Include Three Zero-Days and 75 Critical Vulnerabilities

Microsoft addressed 1,413 vulnerabilities in its October 2026 security update release, including one exploited zero-day vulnerability, two publicly disclosed zero-day vulnerabilities, and 75 Critical vulnerabilities.

October 2026 Risk Analysis

This month's leading risk types by exploitation technique are elevation of privilege with 677 patches (48%), remote code execution (RCE) with 317 patches (22%), and information disclosure with 254 patches (18%).

October 2026 Attack Surface Analysis

Preview Pane-triggered exploitation dominates this release with 23 CVEs across Office applications including Excel, PowerPoint, and Visio. These flaws require minimal user interaction; a victim could simply view a malicious file in the Reading Pane or file explorer preview, eliminating the traditional click-to-compromise barrier that many enterprises rely on as a user training backstop. The attack surface is substantial; any user who receives a weaponized document via download can trigger code execution simply by selecting the file. This class of flaw has historically been attractive to phishing operators and initial access brokers because it converts document delivery into reliable code execution without requiring macro enablement or a user opening the file.

Unauthenticated network-reachable RCE vulnerabilities appear across 15 CVEs this month, spanning Dynamic Host Configuration Protocol (DHCP) Server, Microsoft Quick UDP Internet Connections (QUIC), PostScript Printer Driver, and PDF handling components. These flaws allow remote attackers to execute code without authentication, making them high-value targets for lateral movement and initial network compromise. DHCP servers in particular are deployed on internal networks by design and trust inbound traffic from any client requesting an address. CVE-2026-100219 and CVE-2026-105016 in Microsoft QUIC represent exposure on any service using QUIC transport, which is increasingly common in modern web infrastructure.

Identity platform components carry critical vulnerabilities this month, with RCE and spoofing flaws affecting both Active Directory Domain Services (AD DS) and Active Directory Federation Services (AD FS). CVE-2026-70229 in AD DS enables RCE against domain controllers, while CVE-2026-108131 and CVE-2026-96222 in AD FS present spoofing risks that could enable federated authentication bypass. Compromise of these components can propagate across the entire domain or break trust boundaries between federated identity providers. Similar identity fabric flaws have historically been targeted by advanced adversaries seeking persistent access to enterprise environments.

Microsoft Outlook alone accounts for five critical RCE vulnerabilities this month, including CVE-2026-70242 and CVE-2026-70291, reinforcing email as a persistent high-value attack vector. Outlook's position as the default mail client in most enterprise environments and its deep integration with Exchange and Microsoft 365 services means weaponized messages can reach nearly every employee.

Exploited Zero-Day in Windows Shell

CVE-2026-96951 is an Important security feature bypass vulnerability in Windows Shell and has a CVSS score of 8.8. Microsoft confirms the flaw is being exploited in the wild. Successful exploitation allows an attacker to evade Mark of the Web (MOTW) defenses, the trust boundary mechanism that triggers Protected View in Office documents and SmartScreen warnings for downloaded executables.

The attack vector is social engineering: an attacker delivers a specially crafted file via email, instant message, or web download, and a user must open or click the malicious content. Unlike preview pane vulnerabilities, this flaw requires explicit user action. The security control being bypassed is precisely the one designed to warn users before that action becomes dangerous. Once MOTW is stripped, downstream defenses that rely on the zone tag, including SmartScreen, Office Protected View, and Application Guard, no longer apply.

Windows Shell is present on every Windows endpoint, so the exposed population is effectively the entire Windows install base. The practical impact is that payloads delivered through phishing or watering hole campaigns can execute without the friction that MOTW-aware defenses normally impose. MOTW bypass flaws have historically been attractive to phishing operators and initial access brokers because they reduce the number of warning dialogs a target must dismiss before payload execution.

Publicly Disclosed Vulnerability in .NET Framework

CVE-2026-108398 is an Important security feature bypass vulnerability in .NET Framework and has a CVSS score of 8.8. Microsoft confirms the vulnerability had been publicly disclosed. An authenticated attacker with local access can place a specially crafted .NET assembly on an affected system and register it for loading by a protected process. Successful exploitation bypasses Windows Defender Application Control (WDAC) enforcement, allowing execution of unauthorized code within a protected process context. No user interaction is required.

The attack surface is constrained by the requirement for local authenticated access, but the scope of impact is significant. WDAC is a trust boundary that enterprises deploy specifically to prevent execution of unsigned or unapproved binaries, particularly on high-value systems such as administrative workstations, kiosks, and hardened servers. A bypass that allows an attacker to run arbitrary code inside a WDAC-protected process negates the control entirely for that host, converting a local authenticated foothold into unrestricted code execution despite explicit application allowlist policy.

.NET Framework is installed on virtually every Windows system in the enterprise, which means the vulnerable component is present even where WDAC is not actively enforced. For organizations that rely on WDAC as a compensating control on sensitive endpoints, the combination of public disclosure, no user interaction, and trust boundary bypass makes this flaw more consequential than its Important rating suggests in those environments.

Publicly Disclosed Vulnerability in MessagePack-CSharp

CVE-2026-92707 is a Moderate publicly disclosed denial of service vulnerability in MessagePack-CSharp and has a CVSS score of 5.3. MessagePack-CSharp is a popular binary serialization library for .NET applications. The flaw involves improperly controlled sequential memory allocation, which allows an unauthenticated attacker to exhaust memory resources over a network by sending crafted MessagePack payloads.

The attack surface depends on how the library is deployed. MessagePack-CSharp is commonly used in web APIs, microservices, and real-time communication layers where compact binary serialization offers performance advantages over JSON. Any application that deserializes MessagePack input from untrusted sources, such as public-facing REST endpoints, WebSocket handlers, or message queue consumers, is potentially exposed. The library itself is a NuGet dependency rather than a Windows component, so affected deployments may not be obvious from OS-level inventory alone.

The scope of impact is service availability rather than code execution or data disclosure. For applications that process high volumes of external requests, a memory exhaustion condition can cascade into broader outages if the affected service shares resources with other workloads or lacks adequate isolation.

Remote Code Execution Vulnerabilities in Microsoft Office

This month includes 20 Critical RCE vulnerabilities across Excel, PowerPoint, Visio, and Word, with CVSS scores ranging from 7.5 to 9.8. Six of them list the Preview Pane as an attack vector, and all six are in PowerPoint or Word: CVE-2026-88178 (PowerPoint, CVSS 9.8), CVE-2026-70215 and CVE-2026-88144 (PowerPoint, CVSS 8.8), CVE-2026-70269 and CVE-2026-88185 (Word, CVSS 8.1), and CVE-2026-88207 (PowerPoint, CVSS 7.5). A malicious file can trigger these when a user views it in the Preview Pane without opening it. CVE-2026-88178 is the most severe of the group. Microsoft states that an unauthenticated attacker could exploit it by submitting a crafted presentation to an affected Office Online service, with no authentication or user interaction required. 

The remaining 14 are the 11 Excel and three Visio vulnerabilities, all rated CVSS 8.8. Microsoft states the Preview Pane is not an attack vector for any of them.

The volume and consistency of memory corruption classes (use-after-free, heap-based buffer overflow, out-of-bounds read, integer overflow or underflow) across four Office applications points to broad file-parser exposure. Microsoft Office is deployed on virtually every enterprise endpoint, and phishing operators have historically shown sustained interest in Office-based initial access chains.

Critical Remote Code Execution Vulnerabilities in Microsoft Outlook

CVE-2026-70242, CVE-2026-70291, CVE-2026-88156, CVE-2026-97016, and CVE-2026-97749 are Critical RCE vulnerabilities in Microsoft Outlook, each carrying a CVSS score of 9.8. These flaws include heap-based buffer overflows (CWE-122), a stack-based buffer overflow (CWE-121), and a double free condition (CWE-415), all reachable over the network without authentication. For CVE-2026-70291 and CVE-2026-88156, Microsoft explicitly lists the Preview Pane as an attack vector. An attacker can send a specially crafted email to a target, and simply viewing the message in the Outlook Reading Pane could trigger code execution, without the recipient opening the message or clicking anything. Neither authentication nor user interaction is required.

The attack surface here is effectively every mailbox in an organization. Outlook is a dominant enterprise email client, installed on many corporate endpoints and configured by default to render incoming mail in the Reading Pane. Disabling the Reading Pane imposes a significant productivity cost that many enterprises do not accept, leaving the exposure in place across the user population.

Scope of impact extends beyond the individual workstation. Outlook runs in the context of the logged-in user, so successful exploitation gives an attacker a foothold with that user's credentials, cached tokens, and access to any resources the user can reach. In environments where users have local administrator rights or where Outlook is running on shared terminal servers, the immediate post-exploitation position is even stronger.

Unauthenticated, zero-click, network-reachable memory corruption in a universally deployed client application represents a high-value target class. Similar Outlook flaws have historically drawn attention from both targeted intrusion operators and commodity phishing campaigns because delivery can be indistinguishable from normal email traffic and the interaction requirement is effectively zero.

Critical Vulnerabilities in Microsoft Quick UDP Internet Connections (QUIC)

CVE-2026-100219 and CVE-2026-105016 are Critical RCE vulnerabilities in Microsoft's QUIC implementation, both carrying a CVSS score of 9.8. An unauthenticated attacker can send a specially crafted packet to any service using the affected QUIC library and execute code without user interaction or authentication. The two flaws arise from distinct memory corruption classes, a use-after-free and a heap-based buffer overflow, but share the same exploitation prerequisites and impact.

QUIC is the transport layer underpinning HTTP/3, and its adoption footprint is expanding as web servers, CDN edge nodes, and internal services migrate to the newer protocol stack. Any Windows service built on Microsoft's QUIC library and exposed to untrusted network traffic, whether internet-facing or reachable from a compromised internal segment, represents a potential attack surface. The library ships as a shared component, so affected deployments may not be immediately obvious from application-level inventories.

The exposure profile is shaped by where QUIC listeners are deployed. Internet-facing HTTP/3 endpoints are reachable without prior access. Internal services adopting QUIC for performance or multiplexing benefits inherit the same unauthenticated RCE exposure if an attacker gains network adjacency. Emerging transport protocols of this class have historically drawn attention from advanced adversaries seeking pre-authentication footholds on edge infrastructure.

Critical Remote Code Execution Vulnerabilities in Microsoft PostScript Printer Driver

CVE-2026-70147 and CVE-2026-70153 are Critical RCE vulnerabilities in the Microsoft PostScript Printer Driver, both carrying a CVSS score of 9.8. An unauthenticated attacker can exploit either flaw by sending a specially crafted print job or packet to an affected print service over the network. No user interaction is required.

The attack surface encompasses any system running the Print Spooler service with an exposed PostScript printer driver. In typical enterprise deployments, print servers are often configured to accept inbound connections from broad network segments to support end-user printing, which places them within reach of any attacker who has network access to the print server's listening port. The Print Spooler service runs as SYSTEM by default, so successful exploitation yields the highest local privilege level on the compromised host.

Print servers frequently hold connections to multiple network segments and maintain elevated trust relationships with client workstations, making them valuable pivot points for lateral movement. Organizations that have hardened their print infrastructure following prior spooler-related disclosures may have reduced exposure, but environments that still permit unauthenticated remote print submission face direct risk from these flaws.

Print spooler and printer driver vulnerabilities have historically been targeted by ransomware operators and human-operated intrusion campaigns because they combine unauthenticated network reach with SYSTEM-level code execution on infrastructure that often bridges network boundaries.

Critical Vulnerability in Windows DHCP Server

CVE-2026-96934 is a Critical RCE vulnerability in Windows DHCP Server and has a CVSS score of 9.8. An unauthenticated attacker can send specially crafted packets to a DHCP server and achieve code execution without any user interaction or authentication. The underlying flaw is a use-after-free condition (CWE-416).

DHCP servers by design listen on UDP/67 and must be reachable from every network segment they serve. They typically run with SYSTEM privileges and occupy a trusted position in network infrastructure. Compromise of a DHCP server provides an attacker with a foothold that can influence client configuration across the segments that server handles, including gateway and DNS settings.

Core network infrastructure services with unauthenticated remote reach have historically been attractive targets for adversaries seeking lateral movement paths that do not require harvested credentials.

Critical Vulnerability in Windows Message Queuing Queue Manager

CVE-2026-100202 is a Critical RCE vulnerability in Windows Message Queuing Queue Manager and has a CVSS score of 9.8. An unauthenticated attacker who can reach the MSMQ service over the network can send a specially crafted message that triggers a use-after-free condition, resulting in arbitrary code execution. No user interaction or authentication is required.

MSMQ listens on TCP/1801 by default and runs as SYSTEM. The service is not installed by default on modern Windows Server editions, but it remains present in many enterprise environments where legacy line-of-business applications, middleware platforms, or custom integrations depend on reliable message queuing. Organizations that enabled MSMQ years ago and never revisited the decision may have the service running on systems that were never intended to be network-exposed.

The combination of unauthenticated remote reach, SYSTEM-level execution, and a 9.8 CVSS score creates direct exposure on any host with TCP/1801 reachable from an untrusted network segment. Similar MSMQ vulnerabilities have historically drawn attention from ransomware operators and commodity malware toolkits because the attack pattern supports rapid lateral movement without credential harvesting.

Critical Vulnerability in Windows Text Shaping

CVE-2026-97814 is a Critical RCE vulnerability in Windows Text Shaping and has a CVSS score of 9.8. An unauthenticated attacker can send a specially crafted packet over the network and achieve code execution without any user interaction.

Windows Text Shaping is a core OS component invoked whenever the system renders fonts or processes complex text layout. The attack surface extends beyond direct network services to any scenario where attacker-controlled content triggers text rendering, including document parsing, web content display, and preview operations. The combination of unauthenticated network exploitation and a component embedded deep in the rendering pipeline makes this flaw relevant across a broad range of Windows deployments.

Critical Vulnerability in Windows Raw Image Extension

CVE-2026-21413 is a Critical RCE vulnerability in Windows Raw Image Extension and has a CVSS score of 9.8. The flaw is a heap-based buffer overflow that can be triggered when Windows generates a thumbnail or preview for a specially crafted RAW image file. An attacker does not need the victim to open the file; navigating to a folder containing the malicious image is sufficient to trigger code execution.

The attack surface here is broader than it might appear. RAW image files are common in photography workflows, cloud storage sync folders, and shared network drives. The thumbnail generation trigger means any file-browsing operation that renders previews, including Windows Explorer navigation, search indexing, or third-party file managers that rely on the same codec, can invoke the vulnerable code path. The victim needs only to view a directory listing.

Raw Image Extension is distributed through the Microsoft Store and is installed by default on Windows 10 and Windows 11 systems. Updates are typically delivered automatically through the Microsoft Store, but enterprise environments that restrict Microsoft Store access or use WSUS without Microsoft Store integration may have delayed update delivery. The patched version reaches endpoints through the Microsoft Store update channel, a deployment path that differs from standard Windows Update infrastructure used for OS components.

Image parsing vulnerabilities with low interaction requirements have historically been attractive to phishing operators and initial access brokers because the delivery mechanism, a folder containing a malicious file, fits cleanly into social engineering scenarios involving shared drives, USB media, or cloud-synced directories.

Critical Vulnerabilities in Windows Hyper-V

CVE-2026-102214 and CVE-2026-105733 are Critical RCE vulnerabilities in Windows Hyper-V, both carrying a CVSS score of 8.8. Each allows an authenticated attacker running code inside a guest VM to escape the virtualization boundary and execute arbitrary code on the host. Both are scope-changed vulnerabilities, meaning successful exploitation crosses a trust boundary the CVSS model considers significant.

The attack paths differ slightly. CVE-2026-102214 enables a low-privileged guest user to trigger a use-after-free condition that results in code execution on the Hyper-V host itself. CVE-2026-105733 targets nested virtualization scenarios: an attacker inside a nested guest VM can escape to the intermediate guest acting as a Hyper-V host and gain administrative privileges there. Organizations using nested virtualization for development, lab, or multi-tier isolation face a threat model in which what appears to be a two-layer containment model collapses into a single hop.

CVE-2026-108399 is a Critical elevation of privilege vulnerability in Windows Hyper-V and has a CVSS score of 7.2. A heap-based buffer overflow allows an authenticated attacker operating inside a guest virtual machine to elevate privileges on the host system, escaping the guest boundary. Microsoft notes that the attack complexity is high, requiring deep system knowledge and success depending on environmental factors and additional security measures.

Guest-to-host escapes violate the fundamental isolation guarantee that virtualization provides. In on-premises deployments, a compromised guest that reaches the hypervisor layer can pivot to other virtual machines on the same host or persist below the visibility of guest-resident security tooling. In multi-tenant and cloud-adjacent scenarios, the same class of flaw threatens workload isolation between customers.

Hyper-V is the hypervisor layer for Azure compute and on-premises Windows Server virtualization. It also underpins Windows client features such as Windows Sandbox, Virtualization-Based Security (VBS), and Credential Guard, so the attack surface goes beyond dedicated hypervisor servers to any endpoint that uses Hyper-V for local isolation. Guest-to-host escapes in this component threaten multi-tenant isolation in cloud environments. They also break the assumption that VM boundaries stop attacker lateral movement in on-premises data centers. The high attack complexity makes opportunistic exploitation less likely. Even so, hypervisor escapes have historically drawn attention from advanced adversaries, because a single compromised guest workload can pivot to infrastructure-level access that reaches other tenants or the management plane and undermines trust across an entire virtualized estate.

Critical Elevation of Privilege Vulnerability in Windows Kernel

CVE-2026-96913 is a Critical elevation of privilege vulnerability in the Windows kernel and has a CVSS score of 8.8. A locally authenticated attacker can run a specially crafted application to exploit a heap-based buffer overflow and gain SYSTEM privileges.

The attack surface is local, but the affected component is universal: every Windows workstation and server runs the same kernel code path. Kernel elevation of privilege flaws of this class are commonly chained with browser, document, or remote-service exploits to convert an initial foothold into full system control, a pattern that has historically been attractive to both targeted intrusion operators and commodity exploit kits.

Critical Remote Code Execution Vulnerability in Microsoft Exchange Server

CVE-2026-70571 is a Critical RCE vulnerability in Microsoft Exchange Server and has a CVSS score of 8.1. An unauthenticated attacker can send a specially crafted email to an affected server, triggering a stack-based buffer overflow in the content conversion process. No user interaction is required.

Microsoft rates attack complexity as high because successful exploitation requires detailed knowledge of the target environment and is not guaranteed to succeed. Factors such as system configuration and additional security measures influence whether an attempt results in code execution. However, the attack vector is noteworthy: inbound email is the trigger, which means any internet-facing Exchange server that accepts external mail is reachable without authentication or social engineering.

Exchange Server remains one of the most sensitive on-premises workloads in enterprise environments. It typically runs with elevated privileges, handles sensitive communications, and is network-exposed by design on ports 25, 443, and related mail-flow paths. A successful compromise grants access to email content, internal address lists, and a foothold inside the corporate network perimeter.

This class of flaw in Exchange has historically drawn attention from nation-state actors and ransomware operators because mail servers combine high-value data access with persistent network exposure.

Critical Remote Code Execution Vulnerability in Windows Remote Desktop Services

CVE-2026-70187 is a Critical RCE vulnerability in the Windows Remote Desktop Gateway Service and has a CVSS score of 8.1. An unauthenticated attacker can send a specially crafted packet over the network to achieve code execution without any user interaction. Microsoft notes the attack complexity is high, meaning successful exploitation requires deep understanding of the target system and is not guaranteed across all configurations.

Remote Desktop Gateway is commonly deployed at the network edge to broker RDP connections into corporate environments, typically listening on TCP/443 or TCP/3391. Organizations that expose RD Gateway to the internet to support remote workforce access present the most direct attack surface. The service often runs with SYSTEM privileges on servers positioned as trusted entry points into internal networks, which amplifies the impact of successful compromise.

The high attack complexity rating provides some friction. Edge-facing services with unauthenticated RCE paths remain high-value targets regardless of exploitation difficulty. Attackers willing to invest in reliable exploitation gain a foothold that bypasses perimeter controls entirely. RDP-related vulnerabilities in this class have historically drawn attention from ransomware operators and targeted intrusion operators because they combine external reachability with direct access to internal network segments.

Critical Elevation of Privilege Vulnerability in Microsoft SharePoint

CVE-2026-102866 is a Critical elevation of privilege vulnerability in Microsoft SharePoint and has a CVSS score of 8.1. The flaw stems from improper verification of cryptographic signatures: an unauthenticated attacker who obtains a valid proof token for a targeted user can modify that token and submit it to an affected SharePoint server, authenticating as the victim without user interaction.

Microsoft notes the attack complexity is high because specific protocol settings or configurations must be in place for exploitation to succeed. SharePoint serves as a central document management and collaboration platform in most deployments. Successful impersonation grants access to sensitive content and provides a pivot point for lateral movement within the environment.

Critical Remote Code Execution Vulnerability in Windows Active Directory Domain Services

CVE-2026-70229 is a Critical RCE vulnerability in Windows Active Directory Domain Services and has a CVSS score of 8.1. An unauthenticated attacker can send a specially crafted packet to a domain controller over the network and execute code without any user interaction or authentication. The attack complexity is rated high because exploitation depends on specific network configurations and timing conditions that are not present in every environment.

Domain controllers run AD DS by design and are reachable from every domain-joined system for authentication traffic. The service cannot be disabled without removing the DC role entirely, which means the attack surface exists wherever a domain controller is deployed. While the high attack complexity rating indicates favorable conditions are required, organizations with non-standard network topologies or legacy configurations may inadvertently satisfy those conditions.

Code execution on a domain controller provides immediate access to the authentication layer that every other resource in the domain trusts. An attacker who lands here can extract credential material, modify directory objects, or pivot to any domain-joined system without needing to escalate through intermediate hosts. Unauthenticated RCE flaws targeting core identity infrastructure have historically drawn attention from advanced adversaries because a single successful exploitation attempt can yield environment-wide access.

Critical Spoofing Vulnerabilities in Active Directory Federation Services

CVE-2026-108131 and CVE-2026-96222 are Critical spoofing vulnerabilities in Active Directory Federation Services (AD FS). CVE-2026-108131 has a CVSS score of 7.5 and CVE-2026-96222 has a CVSS score of 7.4. Both allow an unauthenticated network attacker to perform spoofing. CVE-2026-96222 specifically involves improper certificate validation, and Microsoft notes that exploitation requires high attack complexity due to environmental and configuration dependencies.

AD FS brokers federated authentication across organizational trust boundaries. Spoofing flaws in this component can enable token forgery or authentication bypass that propagates to every relying party application trusting the federation service. Organizations still operating on-premises AD FS for hybrid identity or partner federation scenarios carry the exposure. Environments that have fully migrated to cloud-native identity providers are unaffected.

CrowdStrike-Credited Elevation of Privilege Vulnerabilities in Windows

CrowdStrike discovered CVE-2026-97793, CVE-2026-97798, and CVE-2026-97799, three elevation of privilege vulnerabilities affecting distinct Windows components: Windows Setup and Deployment, Windows Error Reporting Service, and Windows Audio Service. All three allow an authenticated local attacker to escalate to SYSTEM privileges. CVE-2026-97793 was discovered by Jonathan Bar Or of the Office of Adversary Strategy. CVE-2026-97799 and CVE-2026-97798 were discovered by the Advanced Research Team.

CVE-2026-97793 in Windows Setup and Deployment carries a CVSS score of 7.0 with high attack complexity, meaning exploitation depends on specific configuration states or protocol settings being present. The Setup and Deployment component is typically active during OS installation, upgrade, and provisioning workflows, which narrows the window of exposure but places it at a point in the system lifecycle where security tooling may not yet be fully operational, and with a wide enough time window for reliable exploitation.

CVE-2026-97798 targets the Windows Error Reporting Service through argument injection and carries a CVSS score of 7.8. This service runs on every Windows installation and operates with elevated privileges to collect and transmit crash data. 

CVE-2026-97799 affects the Windows Audio Service via improper cryptographic signature verification and also carries a CVSS score of 7.8. The Audio Service is present and running by default on all Windows client and server installations where audio functionality has not been explicitly disabled.

All three require local access and prior authentication. They represent post-compromise privilege escalation components that allow an attacker with an initial user-context foothold to reach SYSTEM. Local elevation of privilege flaws of this class have historically been incorporated into human-operated intrusion chains where the initial access vector delivers only standard-user execution.

Additional Patches This Month

The following notable vulnerabilities were considered but did not warrant a dedicated deep-dive this month:

• CVE-2026-100220, Windows Media Video Decoder remote code execution vulnerability (CVSS 8.8)
• CVE-2026-102225, Windows Text Shaping remote code execution vulnerability (CVSS 8.8)
• CVE-2026-108400, HEVC Video Extensions remote code execution vulnerability (CVSS 8.8)
• CVE-2026-108467, Microsoft PostScript Printer Driver remote code execution vulnerability (CVSS 8.8)
• CVE-2026-108471, Windows Virtualization-Based Security (VBS) Enclave elevation of privilege vulnerability (CVSS 8.8)
• CVE-2026-70250, Windows DHCP Client remote code execution vulnerability (CVSS 8.8)
• CVE-2026-83934, Windows GDI+ remote code execution vulnerability (CVSS 8.8)
• CVE-2026-88073, Windows Graphics Kernel Elevation of Privilege Vulnerability (CVSS 8.8)
• CVE-2026-96202, Windows Raw Image Extension remote code execution vulnerability (CVSS 8.8)
• CVE-2026-96914, Windows Virtualization-Based Security (VBS) Enclave elevation of privilege vulnerability (CVSS 8.8)
• CVE-2026-96943, Windows Raw Image Extension remote code execution vulnerability (CVSS 8.8)
• CVE-2026-96952, Microsoft Windows Media Foundation remote code execution vulnerability  (CVSS 8.8)
• CVE-2026-108457, Microsoft Windows PDF remote code execution vulnerability (CVSS 8.1)
• CVE-2026-108460, Windows Message Queuing remote code execution vulnerability (CVSS 8.1)
• CVE-2026-69802, Network Device Enrollment Service (NDES) remote code execution vulnerability (CVSS 8.1)
• CVE-2026-88117, Windows DHCP Server remote code execution vulnerability (CVSS 8.1)
• CVE-2026-88119, Windows DHCP Server remote code execution vulnerability (CVSS 8.1)
• CVE-2026-88120, Windows DHCP Server remote code execution vulnerability (CVSS 8.1)
• CVE-2026-88171, Windows DHCP Server remote code execution vulnerability (CVSS 8.1)
• CVE-2026-88174, Windows Deployment Services remote code execution vulnerability (CVSS 8.1)
• CVE-2026-100215, Microsoft Graphics Component remote code execution vulnerability (CVSS 7.8)
• CVE-2026-108130, Windows Virtualization-Based Security (VBS) Enclave elevation of privilege vulnerability (CVSS 7.8)
• CVE-2026-88074, Windows Virtualization-Based Security (VBS) Enclave elevation of privilege vulnerability (CVSS 7.8)
• CVE-2026-69789, Windows Reliable Multicast Transport Driver (RMCAST) remote code execution vulnerability (CVSS 7.5)
• CVE-2026-102211, Windows Virtualization-Based Security (VBS) Enclave elevation of privilege vulnerability (CVSS 7.0)
• CVE-2026-83917, Windows ALPC elevation of privilege vulnerability (CVSS 7.0)

Microsoft addressed 6 additional Critical or high-CVSS-rated vulnerabilities in its cloud services this month. These have been mitigated server-side by Microsoft and require no customer action; they are listed here for awareness only:

• CVE-2026-96207, Microsoft Partner Center elevation of privilege vulnerability (CVSS 10.0)
• CVE-2026-94510, Microsoft Bookings elevation of privilege vulnerability (CVSS 9.9)
• CVE-2026-88131, Microsoft Dataverse remote code execution vulnerability (CVSS 9.8)
• CVE-2026-69435, Azure SRE Agent elevation of privilege vulnerability (CVSS 9.6)
• CVE-2026-83943, Azure API Center information disclosure vulnerability (CVSS 8.7)
• CVE-2026-83947, Azure Event Grid spoofing vulnerability (CVSS 7.7)

New AI-Powered Capabilities in Falcon Exposure Management 

With CrowdStrike Falcon® Exposure Management, you can automatically classify and prioritize assets, show attack paths targeting client-side exploitation of devices, and integrate with CrowdStrike Falcon® Next-Gen SIEM.

Patch Tuesday Dashboard in the Falcon Platform

For a visual overview of the systems impacted by this month’s vulnerabilities, you can use our Patch Tuesday dashboard. This can be found in the CrowdStrike Falcon® platform within the Exposure Management > Vulnerability Management > Dashboards page. The preset dashboards show the most recent three months of Patch Tuesday vulnerabilities.

Not All Relevant Vulnerabilities Have Patches: Consider Mitigation Strategies

As we have learned with other notable vulnerabilities, such as Log4j, not every highly exploitable vulnerability can be easily patched. As is the case for the ProxyNotShell vulnerabilities, it’s critically important to develop a response plan for how to defend your environments when no patching protocol exists. 

Regular review of your patching strategy should still be a part of your program, but you should also look more holistically at your organization's methods for cybersecurity and improve your overall security posture.

The CrowdStrike Falcon platform regularly collects and analyzes trillions of endpoint events every day from millions of sensors deployed across 176 countries. Watch this demo to see the Falcon platform in action.

Learn More

Learn more about how CrowdStrike Falcon® Exposure Management can help you quickly and easily discover and prioritize vulnerabilities and other types of exposures here.

About CVSS Scores

The Common Vulnerability Scoring System (CVSS) is a free and open industry standard that CrowdStrike and many other cybersecurity organizations use to assess and communicate software vulnerabilities’ severity and characteristics. The CVSS Base Score ranges from 0.0 to 10.0, and the National Vulnerability Database (NVD) adds a severity rating for CVSS scores. Learn more about vulnerability scoring in this article. 

Additional Resources

• For more information on which products are in Microsoft’s Extended Security Updates program, refer to the vendor guidance here.
• Learn how Falcon Exposure Management can help you discover and manage vulnerabilities and other exposures in your environments. 
• Make prioritization painless and efficient. Watch how Falcon Exposure Management enables IT staff to improve visibility with custom filters and team dashboards.
• Test CrowdStrike next-gen antivirus for yourself with a free trial of CrowdStrike® Falcon Prevent™.