Cybersecurity Research

October 2026 Patch Tuesday: One Flaw Already Exploited as Microsoft Fixes 1415 Vulnerabilities

Cisco Talos · 14 Oct 2026

Key Takeaway Prioritise installing this month's Microsoft updates, starting with the Windows Shell flaw already being exploited and the Exchange Server and Active Directory fixes Microsoft considers more likely to be targeted.

Microsoft has released its monthly security update for October 2026, covering 1415 vulnerabilities across a range of products. Of these, 85 are rated "critical", and 67 of those critical issues allow remote code execution (RCE), meaning an attacker could run their own code on an affected system. Microsoft says one vulnerability this month has been exploited in the wild.

The exploited flaw is CVE-2026-96951, a security feature bypass in Windows Shell with a CVSS base score of 8.8. It stems from command injection, a weakness where special elements in input are not handled safely. Microsoft also flags two RCE vulnerabilities as more likely to be exploited: CVE-2026-70229 in Windows Active Directory Domain Services (CVSS 8.1, incorrect authorization) and CVE-2026-70571 in Microsoft Exchange Server (CVSS 8.1, stack-based buffer overflow).

Other notable fixes are rated less likely to be exploited. Three Windows Hyper-V flaws (CVE-2026-105733, CVE-2026-102214 and CVE-2026-108399) cover remote code execution and elevation of privilege, with scores of 8.8, 8.8 and 7.2. CVE-2026-100202, an RCE flaw in Windows Message Queuing Queue Manager, carries the highest score mentioned at 9.8. This summary is based on the opening of the Cisco Talos article, so further details may be covered in the full report.

Patch Tuesday Microsoft Vulnerability Management Exchange Server Windows

Summarised by CISO AI from Cisco Talos, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.