Microsoft released its October 2026 Patch Tuesday updates on 14 October 2026, addressing
1,411 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities
. This represents the largest single Patch Tuesday release in Microsoft’s history, surpassing even the unprecedented September 2026 release that fixed 966 vulnerabilities. For Kent SMEs, the sheer scale of this month’s update—combined with an actively exploited zero-day—demands immediate attention and prioritised deployment.
Unlike October’s earlier quiet update that fixed just one vulnerability, today’s release includes
70 Critical vulnerabilities, including 57 remote code execution flaws, 11 elevation of privilege flaws, and two spoofing vulnerabilities
. The volume and severity of these patches present significant challenges for SME patch management processes, particularly when combined with the urgent need to address active exploitation.
CVE-2026-96951: The Actively Exploited Windows Shell Zero-Day Kent SMEs Must Patch First
CVE-2026-96951 is a Windows Shell Security Feature Bypass Vulnerability that Microsoft patched as an actively exploited zero-day security bypass flaw that allowed attackers to bypass the Mark of the Web security feature
. This is the most urgent fix in this month’s release.
The flaw allows attackers to bypass Mark of the Web (MotW), a Windows security mechanism that identifies files downloaded from the internet and applies additional protections
. When users download files from untrusted sources—such as email attachments or web downloads—Windows normally applies protective warnings and restrictions. CVE-2026-96951 circumvents these protections entirely.
The vulnerability stems from
improper handling of special characters in commands, which can allow attackers to circumvent these protections
. Exploitation occurs
over the network and requires no privileges, but it does need the user to play along
—meaning successful attacks typically involve social engineering to convince users to open malicious files.
CISA wants federal agencies to patch that flaw by October 16, 2026
, highlighting the urgency. Kent SMEs should treat this patch with equivalent priority, deploying it to all Windows systems within 48 hours.
Two Additional Zero-Days: CVE-2026-108398 and CVE-2026-92707
Microsoft also addressed two publicly disclosed zero-day vulnerabilities, though
neither had confirmed active exploitation
:
- CVE-2026-108398—
.NET Framework Security Feature Bypass Vulnerability that can be exploited to run unauthorized applications, with an “Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally” - CVE-2026-92707—
MessagePack-CSharp Denial of Service Vulnerability affecting .NET, where “Improperly controlled sequential memory allocation in .NET allows an unauthorized attacker to deny service over a network”
Critical Exchange Server and Active Directory Vulnerabilities Require Urgent Attention
Beyond the zero-day fixes, this month’s release includes several critical vulnerabilities affecting infrastructure services that many Kent SMEs depend upon.
Microsoft Exchange Server Flaws
Two critical Exchange Server vulnerabilities demand immediate patching for SMEs running on-premises email:
- CVE-2026-70571—
a stack-based buffer overflow flaw in Microsoft Exchange Server may allow an unauthenticated attacker to execute code over a network
, with a CVSS score of 8.1 - CVE-2026-70279—
a spoofing vulnerability affecting Microsoft Exchange Server
These vulnerabilities add to the already significant patch burden for Exchange administrators following the CVE-2026-96940 elevation of privilege vulnerability fixed earlier this month. SMEs still running Exchange Server 2016 or 2019 should note that Extended Security Updates Period 2 ends this month, making migration planning even more critical.
Windows Active Directory Domain Services Remote Code Execution
CVE-2026-70229 is an RCE vulnerability affecting Windows Active Directory Domain Services (AD DS), with a CVSSv3 score of 8.1 and rated as critical
. For Kent SMEs using Active Directory for identity and access management, this vulnerability represents a significant threat to the core authentication infrastructure.
Critical Microsoft Office and QUIC Implementation Flaws
The October release addresses numerous critical remote code execution vulnerabilities in widely deployed productivity and networking components:
Office Application Vulnerabilities
Critical remote code execution vulnerabilities affect Microsoft Office Excel (CVE-2026-100211, CVE-2026-105718), Microsoft Office Visio (CVE-2026-102855, CVE-2026-102856, CVE-2026-102857), and Microsoft Office PowerPoint (CVE-2026-70215)
, all with CVSS scores of 8.8.
These flaws are particularly concerning because many can be exploited through specially crafted documents, potentially requiring only that a user open a malicious file. This attack vector aligns with the broader phishing threats that continue to affect 83% of UK SME cyber incidents.
Microsoft QUIC Protocol Vulnerabilities
CVE-2026-100219 and CVE-2026-105016 are Critical RCE vulnerabilities in Microsoft’s QUIC implementation, both carrying a CVSS score of 9.8
. QUIC (Quick UDP Internet Connections) is increasingly used for web traffic, including by HTTP/3, making these exceptionally severe vulnerabilities with broad potential impact.
Breakdown of the 1,411 Vulnerabilities by Impact Type
The October 2026 Patch Tuesday addresses vulnerabilities across multiple impact categories:
- 677 Elevation of Privilege vulnerabilities
- 317 Remote Code Execution vulnerabilities
- 254 Information Disclosure vulnerabilities
- 73 Denial of Service vulnerabilities
- 40 Security Feature Bypass vulnerabilities
- 28 Spoofing vulnerabilities
The dominance of elevation of privilege vulnerabilities—nearly half the total—reflects the ongoing challenge of securing Windows systems against local privilege escalation, whilst the 317 remote code execution flaws highlight the persistent network-facing risks.
What Kent SMEs Must Do This Week
The unprecedented scale of this Patch Tuesday release requires a structured, prioritised approach:
1. Deploy CVE-2026-96951 Within 48 Hours
The actively exploited Windows Shell zero-day must be your immediate priority. Test and deploy this patch to all Windows endpoints and servers before the end of the week. This vulnerability is already being exploited in the wild, and every day of delay increases exposure.
2. Prioritise Critical Infrastructure Patches
Focus next on systems that provide essential services:
- Exchange Server installations (CVE-2026-70571, CVE-2026-70279)
- Active Directory Domain Controllers (CVE-2026-70229)
- Systems running .NET Framework (CVE-2026-108398)
- Network infrastructure using QUIC (CVE-2026-100219, CVE-2026-105016)
3. Test and Deploy Office Application Patches
The multiple critical Office vulnerabilities should be tested and deployed to user workstations within one week. Given that these can be exploited through malicious documents—a common phishing attack vector—rapid deployment significantly reduces risk.
4. Assess Your Patch Management Capacity
Managing 1,411 patches in a single release challenges even well-resourced IT teams.
Microsoft’s October 2026 security update is unusually broad, with the release addressing 1,415 vulnerabilities across Microsoft products, including 85 that Microsoft classifies as critical
according to Cisco Talos analysis.
If your internal team lacks the capacity or expertise to test and deploy patches of this scale safely and promptly, this is the month that weakness will be exposed. The combination of volume, complexity, and active exploitation leaves no room for delayed or incomplete patching.
5. Verify Backup and Recovery Capabilities
Before deploying patches at this scale, ensure your backup and recovery systems are current and tested. Whilst rare, large patch deployments can occasionally cause compatibility issues. With Q3 2026 ransomware attacks hitting record levels, having verified backups provides essential insurance against both patch-related issues and the ongoing ransomware threat.
6. Review End-of-Support Products
This Patch Tuesday coincides with multiple product end-of-support dates.
The October Patch Tuesday release coincides with the end of support for several Microsoft products, with Windows 11 24H2 Home and Pro editions reaching end of support on October 13, 2026
.
SMEs running unsupported products will not receive these critical patches, leaving systems permanently vulnerable to CVE-2026-96951 and the other 1,410 flaws. Immediate migration is essential.
Why Meridian Micro Can Help Kent SMEs Manage This Unprecedented Patch Release
The October 2026 Patch Tuesday represents a watershed moment for SME security operations. The combination of record-breaking volume, critical severity, and active exploitation exposes the limitations of ad-hoc or under-resourced patch management approaches.
Meridian Micro provides comprehensive patch management and security services for Kent SMEs, including:
- Prioritised patch testing and deployment schedules based on threat intelligence
- 24/7 monitoring to detect exploitation attempts targeting unpatched systems
- Backup verification and recovery planning before major updates
- End-of-support migration planning and execution
- Ongoing vulnerability assessment and remediation
If your team is struggling with the scale and urgency of this month’s patches, or if you want to ensure your SME maintains robust security posture despite the accelerating pace of vulnerability disclosures, contact Meridian Micro today on 01303 883111. Our team in Saltwood, Hythe, provides expert IT support and security services across Kent and the South East, ensuring your systems remain secure, compliant, and operational even during extraordinary patch cycles like October 2026.