In short: On 13 Oct 2026 Microsoft released its monthly Patch Tuesday. According to Tenable it fixes 1,407 vulnerabilities, more than any Patch Tuesday before. Attackers are already exploiting one flaw in the Windows Shell, CVE-2026-96951. There are also critical flaws in Exchange Server, Outlook and Active Directory. For Windows 11 24H2 Home and Pro, Office 2021 and Windows Server 2012 it was the last regular update. As of 30 Oct 2026.

What Microsoft fixed in October

Microsoft bundles security updates and releases them on the second Tuesday of each month, known as Patch Tuesday. Every known flaw carries a globally unique number, the CVE number. Its severity is rated with the CVSS score from 0 to 10, where 10 is the most dangerous.

According to Tenable, the October release covers 1,407 flaws, 69 of them rated critical. In September there were 964. All About Security counts 1,417, the difference comes from different counting methods. According to t-online, 1,102 flaws affect Windows and 134 affect Office, the rest are spread across Exchange Server, SharePoint, SQL Server and developer tools (t-online, 14 Oct 2026).

The flaw already being exploited: CVE-2026-96951

Windows tags files from the internet and from email attachments with an invisible marker, the “Mark of the Web”. Windows, the SmartScreen filter and Office use it to decide whether to warn or to open the file in Protected View. CVE-2026-96951 bypasses this protection: the warning does not appear, even though the file comes from an outside source.

Microsoft rates the flaw CVSS 8.8 and confirms it was exploited before the update. That makes it a zero-day, a flaw attackers knew about before any fix existed. The victim has to open the crafted file, for example an email attachment, a file from a chat or a download via a link. Windows 10 and 11 and several server versions are affected (t-online). CISA added the flaw to its catalog of known exploited vulnerabilities on 13 Oct 2026 and gave federal agencies a deadline of 16 Oct 2026. Who is exploiting the flaw, and against whom, is not publicly known (as of 30 Oct 2026).

Further critical flaws for companies

“Remote code execution” means an attacker can run their own commands on the system as if sitting in front of it. These flaws matter most for company networks (figures from Vicarius and All About Security):

  • Exchange Server, CVE-2026-70571 (CVSS 8.1, critical): a crafted email can run code on the mail server without any login. Microsoft rates the attack complexity as high but considers exploitation more likely. CVE-2026-96940 (CVSS 8.8) also lets attackers read other mailboxes. According to Microsoft, Exchange Online is already protected, on-premises servers are affected.
  • Outlook, CVE-2026-70242 (CVSS 9.8, critical): displaying an email in the reading pane can be enough, no click needed. Four related Outlook flaws have the same score.
  • Active Directory, CVE-2026-70229 (CVSS 8.1, critical): in most companies Active Directory manages all user accounts and permissions. Running code here often means taking over the whole network.
  • Network services: ten flaws in the Windows DHCP server, which assigns addresses to devices on the network, plus flaws in the DNS server (CVE-2026-83869, CVSS 9.8) and the Remote Desktop Gateway (CVE-2026-70187).

End of support: these systems get no more updates

End of support means Microsoft no longer ships security updates for these versions. New flaws stay open for good. Since 13 Oct 2026 this applies to:

  • Windows 11 24H2 Home and Pro: update KB5127648 was the last regular one. Microsoft recommends moving to 25H2 or 26H2 (t-online).
  • Office 2021 and Office LTSC 2021
  • Windows Server 2012 and 2012 R2: including ESU, the paid Extended Security Updates (Hagel IT).
  • Windows 10: updates only for devices enrolled in ESU.

What companies can do now

  1. Close CVE-2026-96951 first. Install the October update on all Windows clients and servers and check in your software deployment tool that it really is installed everywhere. Do not forget devices at home offices.
  2. Exchange, domain controllers and network services next. On-premises Exchange servers, Active Directory servers and DHCP, DNS and Remote Desktop servers give attackers the most leverage.
  3. List legacy systems. Record every device running Windows Server 2012, Windows 11 24H2 Home or Pro and Office 2021. Set an upgrade date for each one or separate it from the rest of the network until then.
  4. Brief staff. Because the warning may not appear for manipulated files: open unexpected attachments, ZIP files and downloads only once the sender is confirmed through a second channel.
  5. Run patch management as a fixed process. Clear deadlines per severity, for example a few days for exploited flaws. For entities covered by the German NIS 2 Implementation Act, vulnerability handling is one of the risk management measures under Section 30 BSIG. A documented process is therefore also evidence.

How GermanAI Defense supports you

Our Cybersecurity Services include vulnerability management: we record your systems, show which updates are missing and which legacy systems run without support, and prioritise by real risk instead of by list. A penetration test also checks whether an open flaw can actually be exploited in your environment. On top comes round-the-clock SOC monitoring, service and response times as per contract.

→ More about our Cybersecurity Services: View Cybersecurity Services

More current cases: SafePay ransomware, PHP2Shell and Node2Shell

Sources: t-online, 14 Oct 2026 · All About Security, 14 Oct 2026 · Vicarius, October 2026 Patch Tuesday analysis · Hagel IT citing Tenable, October 2026 · CISA Known Exploited Vulnerabilities catalog · Microsoft Security Update Guide