October 2026 Patch Tuesday: Shell Zero-Day and Exchange Deadline

Last updated: 26 October 2026. Sources are listed at the end.

Microsoft released its October 2026 Patch Tuesday updates on 13 October 2026. It is the largest monthly release Microsoft has ever shipped, at roughly 1,400 CVEs. One Windows Shell flaw, CVE-2026-96951, was already being exploited before the fix arrived. Two more bugs were publicly known before patches existed.

The October 2026 Patch Tuesday week also closed several support windows. Windows 11 24H2 Home and Pro, Office LTSC 2021 and Windows Server 2012 ESU all received their last updates. In addition, the paid extended support programme for Exchange Server 2016 and 2019 ends this month. As a result, many small businesses now face two jobs at once: patching and replacing software that will never be patched again.

This guide sets out what to patch first, how to confirm the updates landed, and what to do about out-of-support Exchange servers.

Free tool: Can criminals send email in your company’s name? Check SPF, DKIM and DMARC with our email security checker.

The short answer

• Install the October Windows cumulative update on every PC and server this week, starting with machines that handle outside email and downloads.
• Update Microsoft 365 Apps or Office as well, because five critical Outlook bugs and a critical PowerPoint bug sit in that layer.
• If you run Exchange 2016 or 2019 on-premises, apply the October security update now, then plan a move to Exchange Server SE or Exchange Online.
• Upgrade Windows 11 24H2 Home and Pro PCs to a supported version; they will get no more fixes.
• Check build numbers, not just “update installed” messages, to prove coverage.

What the October 2026 Patch Tuesday fixed

Reported totals differ, so treat the headline number loosely. BleepingComputer counts 1,411 flaws and excludes 348 fixed earlier in October. CrowdStrike and Dark Reading count 1,413. Security Affairs gives 1,415, while Microsoft’s own release note lists 1,453 Microsoft CVEs for the month. The differences come from how each outlet treats earlier October fixes and non-Microsoft CVEs. However, the exact figure matters far less than the handful of bugs below.

Critical counts also vary: 70 per BleepingComputer, 75 per CrowdStrike and 80 per Dark Reading. Elevation of privilege bugs make up nearly half the release. Fortra’s Tyler Reguly told Dark Reading that the raw count is not a useful risk measure. Instead, exploitation status should drive the order you patch in.

The exploited zero-day: CVE-2026-96951 (Windows Shell)

Microsoft marks this Windows Shell security feature bypass as exploited. It carries a CVSS score of 8.8. Microsoft describes it as a command injection weakness that lets an attacker bypass Mark of the Web protection. The victim still has to open a crafted file or click a link, so phishing is the obvious delivery route. Microsoft has not shared who reported it or how attackers used it.

Security Affairs reports that CISA added the flaw to its Known Exploited Vulnerabilities catalogue, with a US federal deadline of 16 October 2026. That three-day window shows how seriously CISA rates it.

What Mark of the Web does, and why a bypass matters

When you download a file or save an email attachment, Windows tags it with a hidden label. This label, called Mark of the Web (MOTW), lives in an NTFS data stream named Zone.Identifier. It records that the file came from the internet.

Several defences rely on that tag. For example, Windows shows a warning before running the file, and Office blocks macros in tagged documents. Automox, quoted by Dark Reading, says a bypass can make a malicious file look locally created. Consequently, SmartScreen, Protected View and macro blocking may never trigger. The attacker’s file then runs with far less friction.

The two publicly disclosed bugs

• CVE-2026-108398 (.NET Framework, CVSS 8.8): a local attacker with low privileges can escape Windows Defender Application Control (WDAC). James Forshaw of Google Project Zero is credited. It matters most if you use WDAC or App Control.
• CVE-2026-92707 (MessagePack-CSharp, CVSS 5.3): an unauthenticated denial of service through memory exhaustion. Windows Update does not fix this one. Developers must update the library in their .NET apps and rebuild.

October 2026 Patch Tuesday bugs that fire from a preview

CrowdStrike counts 23 Office CVEs that can be triggered through the Preview Pane. The most serious ones for small offices are these:

• Outlook RCEs: five critical bugs rated 9.8, including CVE-2026-70242 and CVE-2026-70291. CrowdStrike lists the Preview Pane as a vector for CVE-2026-70291 and CVE-2026-88156. Dark Reading describes CVE-2026-70242 as a Reading Pane bug too, so sources differ slightly on which ones apply.
• CVE-2026-88178 (PowerPoint, 9.8): exploitable without authentication through a crafted file sent to an affected Office Online service.
• CVE-2026-21413 (Raw Image Extension, 9.8): a Cisco Talos bug that Microsoft republished. According to CrowdStrike, simply viewing a folder containing a malicious image can trigger it.
• CVE-2026-70571 (Exchange Server, 8.1): a stack-based buffer overflow that an unauthenticated attacker can reach over the network. Attack complexity is rated high.

None of these are listed as exploited yet. Still, they need no clicks beyond opening a mailbox or a folder, so they belong near the top of the queue.

Am I affected?

If a Windows PC or server has not installed the October 2026 Patch Tuesday update, yes. The table lists the main updates and the fixed builds where a source confirms them.

Check the Windows build

Run winver for a quick look. Otherwise, run this in PowerShell on each machine:

$v = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
$v | Select-Object ProductName, DisplayVersion, CurrentBuild, UBR
if ([int]$v.CurrentBuild -in 26100, 26200, 26300) {
  if ([int]$v.UBR -ge 9711) { 'October 2026 update (or later) is installed' }
  else { 'Older build: install KB5127648 and reboot' }
}

The build check is more reliable than looking for one KB number. That is because a later cumulative update replaces the October one. Even so, Get-HotFix gives a useful second signal:

Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 HotFixID, InstalledOn
Get-HotFix -Id KB5127648 -ErrorAction SilentlyContinue

Check Exchange

In the Exchange Management Shell, this lists each server’s edition and version (syntax from Microsoft’s Exchange documentation):

Get-ExchangeServer | Format-Table Name, Edition, AdminDisplayVersion

The support deadlines you cannot ignore

Windows 11 24H2 Enterprise and Education remain supported until October 2027. For Home and Pro PCs, Microsoft recommends moving to the newest release, 26H2. Microsoft offers no ESU for Office 2021, so the realistic paths are Microsoft 365 Apps or Office LTSC 2024.

Exchange 2016 and 2019: a correction to the usual dates

Some roundups say Exchange 2016 and 2019 reach end of support on 15 October 2026. In fact, mainstream product support ended on 14 October 2025. What ends now is the paid Extended Security Update programme. Microsoft has said there will be no further extension. It also said that once October 2026 ends, no more updates will ship, even for Period 2 customers. Messageware gives the Period 2 end date as 31 October 2026. Therefore, the October security update is effectively the last one these servers will get.

Your realistic options are:

1. Exchange Server SE: Exchange 2019 CU14 or CU15 can upgrade in place, much like installing a cumulative update. Run Microsoft’s Exchange Health Checker first.
2. Exchange 2016 to SE: no in-place path exists. Build new SE servers and move mailboxes, or go through Exchange 2019 first.
3. Exchange Online: for most small firms, moving mailboxes to Microsoft 365 removes the patching burden entirely.

Meanwhile, keep any remaining 2016/2019 servers off the open internet wherever possible.

Temporary mitigations while you roll out patches

Installing the October 2026 Patch Tuesday updates is the fix. However, a few settings reduce exposure during the rollout.

• Turn off the Outlook Reading Pane for staff who receive heavy outside email (View, then Reading Pane, then Off). It lowers the risk from preview bugs, but it does not remove it.
• Leave the File Explorer preview pane off. Since October 2025, Windows already disables preview for internet-downloaded files.
• Keep SmartScreen and Protected View enforced by policy, as SOCRadar advises.

ASR rules worth turning on

Attack Surface Reduction (ASR) rules in Microsoft Defender Antivirus block common phishing follow-up steps. They work on any Windows edition with Defender Antivirus, but some need cloud protection enabled. Start in audit mode first, so you can see what would break. The rule IDs below come from Microsoft’s ASR reference:

Add-MpPreference -AttackSurfaceReductionRules_Ids be9ba2d9-53ea-4cdc-84e5-9b1eeee46550,d4f940ab-401b-4efc-aadc-ad5f3c50688a,3b576869-a4ec-4529-8536-b80a7769e899,d3e037e1-3eb8-44c8-a917-57927947596d -AttackSurfaceReductionRules_Actions AuditMode,AuditMode,AuditMode,AuditMode

These cover executable content from email, Office child processes, Office creating executables, and scripts launching downloads. After a week, review audit hits (event ID 1122):

Get-WinEvent -LogName 'Microsoft-Windows-Windows Defender/Operational' -MaxEvents 500 | Where-Object Id -eq 1122 | Select-Object -First 20 TimeCreated, Message

Then switch quiet rules to Enabled (block mode).

Were we already hit?

Microsoft has not published indicators of compromise for CVE-2026-96951, the only exploited October 2026 Patch Tuesday bug. So there is no file hash or domain to search for. Instead, look for the pattern. Check Defender alerts and email logs since early October for attachments that opened without the usual warnings. Also review any unexpected processes started by Outlook, Word or Explorer. To see whether a saved file still carries its MOTW tag, run:

Get-Content -Path "$env:USERPROFILE\Downloads\invoice.docx" -Stream Zone.Identifier

An error saying the stream does not exist means the file has no tag.

The India angle

Many Indian SMBs still run perpetual Office 2021 licences and older on-premises Exchange servers. Both now sit outside support. If you find evidence of compromise, remember that CERT-In’s April 2022 Directions require covered entities to report certain incidents within six hours. Separately, DPDP Rule 7 breach notification applies only from May 2027 and is not in force yet. Even so, it is sensible to build the habit now.

Quick checklist

• ☐ October 2026 Patch Tuesday cumulative update installed on every Windows PC and server
• ☐ Builds checked (for example 26100.9711 or later on Windows 11 24H2)
• ☐ Microsoft 365 Apps or Office updated, and Outlook restarted
• ☐ Exchange October security update applied; migration plan to SE or Exchange Online agreed
• ☐ MessagePack-CSharp updated in in-house .NET apps
• ☐ Windows 11 24H2 Home/Pro PCs upgraded to 25H2 or 26H2
• ☐ Office 2021 replaced; Server 2012 retired or isolated
• ☐ Windows 11 23H2 Enterprise upgrades scheduled before 10 November
• ☐ ASR rules in audit mode, with a date set to review them

If you want a second pair of eyes on exposed Exchange or Windows servers, our VAPT services cover external attack surface testing. For context on why October felt so busy, see our Black October 2026 fact-check.

Sources

• BleepingComputer: Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days
• CrowdStrike: October 2026 Patch Tuesday analysis
• Microsoft Security Update Guide: October 2026 release note
• Microsoft Support: KB5127648 (OS Builds 26300.9711, 26200.9711 and 26100.9711)
• Dark Reading: Zero-days lurk in Microsoft’s overgrown October Patch Tuesday
• Security Affairs: CISA adds Microsoft Windows Shell flaw to KEV
• BleepingComputer: Microsoft Exchange 2016 and 2019 ESU program ends in October
• Microsoft Learn: Attack surface reduction rules reference

Need help finding and fixing exposed systems? Our VAPT services find unpatched and exposed systems before attackers do, and our free website safety check grades your site in seconds. Contact us for a quote.