Microsoft Patch Tuesday Analysis – October 2026

Executive Summary

On Tuesday, October 13, 2026, Microsoft released its monthly security patch, addressing 1417 vulnerabilities across its products.

By severity level:

• None - 2;
• Important - 1337;
• Critical - 76;
• Low - 1;
• No Info - 1.

Exploited (Zero-Days) and Publicly Disclosed Vulnerabilities

Special attention should be paid to the following 2 vulnerabilities. Patching them is of the highest priority:

• CVE-2026-108398 (CVSS 8.8; Important) - .NET Framework Security Feature Bypass Vulnerability (Security Feature Bypass). An Untrusted Search Path vulnerability in the .NET Framework allows a local authenticated attacker to bypass Windows Defender Application Control (WDAC) restrictions. The attacker can place a specially crafted .NET assembly on the system and trigger its loading by a trusted process, enabling them to bypass application control policies and execute unauthorized code in the context of a protected process without user interaction.
• CVE-2026-96951 (CVSS 8.8; Important) - Windows Shell Security Feature Bypass Vulnerability (Security Feature Bypass). A Command Injection vulnerability in the Windows Shell component associated with improper neutralization of special characters. A remote attacker could send a specially crafted file or link to a victim via email or a messenger. Opening it allows the attacker to bypass the Mark of the Web (MOTW) defense mechanisms and execute a malicious script without standard security warnings.

General Trends

In the October 2026 Patch Tuesday, Microsoft released fixes for 1417 vulnerabilities, of which 76 are critical. Key trends for October:

• Zero-Day Attacks on End Users: Active exploitation "in the wild" of the Windows Shell vulnerability (CVE-2026-96951) has been detected. This is a critical bypass of the Mark of the Web (MOTW) mechanism. Attackers are actively utilizing this flaw in ongoing phishing campaigns (via email and messengers) to stealthily launch malicious code on victims' machines, bypassing SmartScreen warnings.
• Subverting Trust and Control Mechanisms (Security Feature Bypass): Alongside the exploited vulnerability in the Shell, details of a Windows Defender Application Control (WDAC) bypass via the .NET Framework (CVE-2026-108398) have been publicly disclosed. Attackers' focus has shifted from classic memory corruption to elegant bypasses of built-in OS security policies, enabling the legitimization of malicious activity on the system.
• Colossal RCE Attack Surface: Hundreds of Remote Code Execution (RCE) vulnerabilities were patched this month. Both infrastructure protocols (MSMQ, QUIC, NPS, RRAS) and application solutions (Microsoft Office, SQL Server, SharePoint, Access, Visio) are under attack. The presence of multiple RCEs in the QUIC protocol and MSMQ message queuing creates an ideal breeding ground for rapid lateral movement within corporate networks.
• Dominance of Local Elevation of Privilege (EoP): Out of the 1417 vulnerabilities, nearly a thousand are aimed at local privilege escalation. Absolutely everything is vulnerable: from file system drivers and the kernel to the graphics subsystem (Win32k, DWM) and dozens of Windows background services. On an unpatched machine, an attacker is guaranteed to find a way to obtain SYSTEM privileges.

Full List of Vulnerabilities

Below is a table of all the vulnerabilities patched this month.