/
← Voltar ao feed
critical

Microsoft October 2026 Patch Tuesday: record 1,415 CVEs, one exploited Windows Shell zero-day, plus 174 Adobe fixes

1 fonte(s) · 1 atualização(ões) · publicado 13/10/2026 16:34 · coletado há 8 horas

Microsoft's October 2026 Patch Tuesday is a record release of roughly 1,415 new CVEs, the first four-digit volume ever, larger than any previous full year of Microsoft patches. Only one flaw is under active attack: CVE-2026-96951, a Windows Shell security feature bypass that evades Mark of the Web (MotW) protections. Two others are publicly known: CVE-2026-108398 (.NET Framework WDAC bypass) and CVE-2026-92707 (MessagePack-CSharp DoS). Adobe separately released 11 bulletins covering 174 CVEs, with ColdFusion, Commerce and Experience Manager as the Priority 2 updates. ZDI counts 59 wormable-class CVEs and notes that bug discovery, likely AI-assisted, is scaling faster than exploitation.

Technical Details

  • CVE-2026-96951: Windows Shell MotW security feature bypass, actively exploited; similar to earlier SmartScreen-based MotW bypasses.
  • CVE-2026-102866: SharePoint, the only Critical SharePoint CVE (CVSS 8.1) and exploitable unauthenticated. Improper cryptographic signature verification lets an attacker who holds a valid proof token modify it and authenticate as the targeted user.
  • CVE-2026-65674: SQL Server RCE (CVSS 8.8) via deserialization of untrusted data. It requires authentication but no user interaction.
  • CVE-2026-70571: Exchange Server RCE, technically wormable, but Microsoft says exploitation requires deep knowledge of the target and is not guaranteed.
  • 59 wormable-class CVEs, concentrated in DHCP Server (6), Network Policy Server (4), Windows Error Reporting (4), Remote Desktop Gateway (3), Text Shaping (3), plus DNS Server, Schannel, QUIC, RRAS, IIS, TCP/IP, LSASS and others. ZDI notes some descriptions are ambiguous.
  • Office: five Critical Outlook RCEs (CVSS 9.8) triggered by viewing the email in the Reading Pane, with no click or authentication. Many Excel, Word and PowerPoint RCEs work through the Preview Pane.
  • CVE-2026-100202: Message Queuing use-after-free RCE (CVSS 9.8). MSMQ is not enabled by default.
  • CVE-2026-103572: SQL Server Management Studio prompt injection via Copilot leading to code execution.
  • Hyper-V guest-to-host RCEs (CVE-2026-102214, CVE-2026-105733); Windows Installer (35 EoPs) and NTFS (five sandbox escapes) are likely post-compromise chain components.
  • Of 677 EoP bugs, 606 lead to SYSTEM, administrator or root.
  • Adobe ColdFusion: 10 Critical CVEs including a CVSS 10 bug, with unrestricted file upload, code injection, SSRF and incorrect authorization, a pre-auth RCE profile. Adobe Commerce: template-engine injection and incorrect authorization, following last month's exploited zero-day CVE-2026-75650. Experience Manager: OS command injection, SQL injection, XXE and path traversal. None of the other Adobe bugs is listed as public or exploited.
  • Microsoft introduces non-official "risk cohorts" to help group CVEs for analysis.

Remediation

  • Test and deploy the CVE-2026-96951 patch on an expedited basis.
  • Prioritize the Adobe ColdFusion, Commerce and Experience Manager updates, and internet-facing SQL Server, SharePoint, Exchange, DHCP, RD Gateway and DNS Server systems.
  • Patch Outlook and other Office components with Reading Pane or Preview Pane vectors.
  • Triage by exploitability rather than raw CVE count. Do not skip SharePoint RCEs that need only low-level permissions.
  • Next Patch Tuesday is November 10.

Linha do tempo

  1. thezdi.com ↗ · pub. 13/10/2026 16:34 · coletado 20/10 16:31 primeiro registro

    Microsoft October 2026 Patch Tuesday: record 1,415 CVEs, one exploited Windows Shell zero-day, plus 174 Adobe fixes

    ler a análise desta fonte

    Microsoft's October 2026 Patch Tuesday is a record release of roughly 1,415 new CVEs, the first four-digit volume ever, larger than any previous full year of Microsoft patches. Only one flaw is under active attack: CVE-2026-96951, a Windows Shell security feature bypass that evades Mark of the Web (MotW) protections. Two others are publicly known: CVE-2026-108398 (.NET Framework WDAC bypass) and CVE-2026-92707 (MessagePack-CSharp DoS). Adobe separately released 11 bulletins covering 174 CVEs, with ColdFusion, Commerce and Experience Manager as the Priority 2 updates. ZDI counts 59 wormable-class CVEs and notes that bug discovery, likely AI-assisted, is scaling faster than exploitation.

    Technical Details

    • CVE-2026-96951: Windows Shell MotW security feature bypass, actively exploited; similar to earlier SmartScreen-based MotW bypasses.
    • CVE-2026-102866: SharePoint, the only Critical SharePoint CVE (CVSS 8.1) and exploitable unauthenticated. Improper cryptographic signature verification lets an attacker who holds a valid proof token modify it and authenticate as the targeted user.
    • CVE-2026-65674: SQL Server RCE (CVSS 8.8) via deserialization of untrusted data. It requires authentication but no user interaction.
    • CVE-2026-70571: Exchange Server RCE, technically wormable, but Microsoft says exploitation requires deep knowledge of the target and is not guaranteed.
    • 59 wormable-class CVEs, concentrated in DHCP Server (6), Network Policy Server (4), Windows Error Reporting (4), Remote Desktop Gateway (3), Text Shaping (3), plus DNS Server, Schannel, QUIC, RRAS, IIS, TCP/IP, LSASS and others. ZDI notes some descriptions are ambiguous.
    • Office: five Critical Outlook RCEs (CVSS 9.8) triggered by viewing the email in the Reading Pane, with no click or authentication. Many Excel, Word and PowerPoint RCEs work through the Preview Pane.
    • CVE-2026-100202: Message Queuing use-after-free RCE (CVSS 9.8). MSMQ is not enabled by default.
    • CVE-2026-103572: SQL Server Management Studio prompt injection via Copilot leading to code execution.
    • Hyper-V guest-to-host RCEs (CVE-2026-102214, CVE-2026-105733); Windows Installer (35 EoPs) and NTFS (five sandbox escapes) are likely post-compromise chain components.
    • Of 677 EoP bugs, 606 lead to SYSTEM, administrator or root.
    • Adobe ColdFusion: 10 Critical CVEs including a CVSS 10 bug, with unrestricted file upload, code injection, SSRF and incorrect authorization, a pre-auth RCE profile. Adobe Commerce: template-engine injection and incorrect authorization, following last month's exploited zero-day CVE-2026-75650. Experience Manager: OS command injection, SQL injection, XXE and path traversal. None of the other Adobe bugs is listed as public or exploited.
    • Microsoft introduces non-official "risk cohorts" to help group CVEs for analysis.

    Remediation

    • Test and deploy the CVE-2026-96951 patch on an expedited basis.
    • Prioritize the Adobe ColdFusion, Commerce and Experience Manager updates, and internet-facing SQL Server, SharePoint, Exchange, DHCP, RD Gateway and DNS Server systems.
    • Patch Outlook and other Office components with Reading Pane or Preview Pane vectors.
    • Triage by exploitability rather than raw CVE count. Do not skip SharePoint RCEs that need only low-level permissions.
    • Next Patch Tuesday is November 10.