Microsoft's October 2026 Patch Tuesday fixes more than 1,400 vulnerabilities, a release The Hacker News calls a record, and one Windows Shell bypass is already being exploited. Identity teams should look past the count: domain controllers, AD FS and AD CS all get fixes this month.
What happened
Microsoft shipped the updates on October 13. The totals differ by roundup. The Hacker News counts 1,413 CVEs and more than 70 Critical, SANS ISC counts 1,417 with 76 Critical, Cisco Talos counts 1,415 with 85 Critical, and Krebs on Security reports more than 1,400 with at least 78 Critical. By The Hacker News' breakdown, 1,102 of the fixes are in Windows and 134 are in Office.
- CVE-2026-96951 (CVSS 8.8, per The Hacker News) is a Windows Shell security feature bypass that is exploited in the wild. Krebs says it affects Windows 10, Windows 11 and some Server versions. According to Microsoft, attackers can send crafted files by email or messaging to get around Mark of the Web (MOTW) protections. CISA added it to KEV, and The Hacker News reports a federal deadline of October 16, 2026.
- CVE-2026-108398 (CVSS 8.8) is a .NET Framework security feature bypass that was publicly disclosed before the patch. The Hacker News says it can bypass Windows Defender Application Control (WDAC) enforcement. No exploitation has been reported.
Why it matters
In a release this large, the identity-infrastructure fixes are easy to miss. SANS ISC and Cisco Talos list these:
- AD DS: two remote code execution flaws. CVE-2026-70229 is rated Critical (CVSS 8.1), and Talos lists it among the flaws Microsoft considers more likely to be exploited. CVE-2026-88165 is rated Important (CVSS 8.8). SANS also lists three AD DS denial-of-service fixes.
- AD FS: Talos highlights two spoofing flaws, CVE-2026-96222 (CVSS 7.4, improper certificate validation) and CVE-2026-108131 (CVSS 7.5). SANS lists further AD FS denial-of-service, information disclosure and security feature bypass fixes.
- AD CS: CVE-2026-83666, an elevation of privilege flaw (Important, CVSS 7.0), per SANS.
- Kerberos: Talos lists a Windows Kerberos elevation of privilege flaw, CVE-2026-70241. None of the sources reviewed gave further detail.
None of these is reported as exploited or publicly disclosed. Even so, a domain controller RCE, an AD FS certificate-validation spoofing flaw and an AD CS privilege escalation all sit on paths to domain-wide or federation-wide trust. They are also on the servers most often pushed to a later maintenance window. These details come from third-party roundups, so confirm prerequisites and affected versions in the Microsoft Security Update Guide.
CVE-2026-96951 has an identity angle too. A MOTW bypass removes a warning that stands between a phishing attachment and code running on a workstation, which is a common first step toward credential and token theft.
"Hundreds of CVEs in a single release used to be the exception; now it's the baseline." — Dustin Childs, Zero Day Initiative, via The Hacker News
What to check in your environment
- Confirm the October cumulative update has been deployed to workstations and servers for CVE-2026-96951. Federal agencies have to meet the October 16 KEV deadline. Use it as your own target too.
- Put domain controllers, AD FS servers (including any Web Application Proxy tier) and AD CS certificate authorities in a dedicated patch group for this month, with a named owner and date.
- Look up CVE-2026-70229, CVE-2026-88165, CVE-2026-96222, CVE-2026-108131, CVE-2026-83666 and CVE-2026-70241 in the Update Guide. Record the affected versions and any mitigations before you schedule reboots.
- Where WDAC is a control you depend on, confirm that the .NET Framework updates for CVE-2026-108398 are reaching those systems.
- Until CVE-2026-96951 patching is finished, review your controls on email and messaging attachments, since those are the delivery channels.
- Reconcile your patch tracking against the Update Guide, not press counts, which range from 1,413 to 1,417 this month.