Welcome to our October 2026 Patch Tuesday recap, the spooky edition! With Halloween just a couple of weeks away, I’ve been thinking about what really scares me, and it’s not ghosts, zombies, or clowns in storm drains. It’s the thought of another 974-CVE month like September coming back to haunt me.
Grab your caffeinated potion of choice and let’s find out what skeletons Microsoft is letting out of the closet this month.
Severity
Total exploits patched: 1,414
Critical patches: 78
Important: 1,331
Moderate: 1
Low: 0
Vulnerability impact
Remote code execution: 315
Elevation of privilege: 675
Information disclosure: 252
Spoofing: 27
Tampering: 29
Denial of service: 72
Feature bypass: 40
Availability
Publicly disclosed: 1
Actively exploited: 1
Some highlights (or lowlights)
CVE-2026-96951: Our only actively exploited CVE this month is a Windows Shell security feature bypass rated 8.8. It strips the Mark of the Web tag from downloaded files, which means SmartScreen, Protected View, and macro blocking never get a chance to warn the user. It still requires someone to open the file, but we all know how that goes. Windows Shell also showed up in February’s exploited bypass trio, so Microsoft’s shell game continues.
CVE-2026-108398: Next is a publicly known .NET Framework security feature bypass that lets a local, low-privilege attacker run code in a protected process without tripping Windows Defender Application Control. If you’ve spent months tuning your WDAC policies, this one is a rude reminder that someone can walk right around them. Microsoft rates exploitation as less likely, but it affects .NET Framework 3.5 through 4.8.1, so it’s probably haunting every Windows machine you own.
CVE-2026-70229: Last up is a critical remote code execution vulnerability in Active Directory Domain Services, rated 8.1. An unauthenticated attacker could send specially crafted network packets to exploit an authorization flaw, with no credentials or user interaction required. Exploitation depends on specific network conditions and timing, but when the target holds the keys to your entire domain, “difficult” isn’t much comfort, so get your domain controllers tested and patched.
Wrapping up
That wraps up the October 2026 Patch Tuesday recap. Nothing is scarier than an unpatched endpoint lurking in the dark, except maybe an unsupported Windows 10 machine. Don’t let them haunt your network. Test your updates, keep a rollback plan handy, and let PDQ automate your Windows and third-party patch deployments so you can spend Halloween handing out candy instead of chasing down vulnerabilities.
Until next month, stay patched, stay caffeinated, and don’t open any suspicious attachments, even if they promise full-size candy bars.
