Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities

Microsoft has released its monthly security update for October 2026, which includes 1415 vulnerabilities affecting a range of products, including 85 that Microsoft marked as "critical."

Microsoft notes that 1 of the vulnerabilities disclosed this month have been exploited in the wild

CVE-2026-96951is a security feature bypass vulnerability that affects Windows Shell. The shared weakness is Improper Neutralization of Special Elements used in a Command ('Command Injection'). The vulnerability has a CVSS base score of 8.8.

Out of 85 "critical" vulnerabilities, 67 are remote code execution (RCE) vulnerabilities.

Microsoft considers exploitation of the following vulnerabilities more likely.

CVE-2026-70229is a remote code execution vulnerability that affects Windows Active Directory Domain Services. The shared weakness is Incorrect Authorization. The vulnerability has a CVSS base score of 8.1.

CVE-2026-70571is a remote code execution vulnerability that affects Microsoft Exchange Server. The shared weakness is Stack-based Buffer Overflow. The vulnerability has a CVSS base score of 8.1.

Microsoft considers exploitation of the following vulnerabilities less likely.

CVE-2026-105733,CVE-2026-102214, andCVE-2026-108399affect Windows Hyper-V.CVE-2026-105733has an impact of remote code execution; involves Incorrect Initialization of Resource; has a CVSS base score of 8.8.CVE-2026-102214has an impact of remote code execution; involves Use After Free; has a CVSS base score of 8.8.CVE-2026-108399has an impact of elevation of privilege; involves Heap-based Buffer Overflow; has a CVSS base score of 7.2.

CVE-2026-100202is a remote code execution vulnerability that affects Windows Message Queuing Queue Manager. The shared weakness is Use After Free. The vulnerability has a CVSS base score of 9.8.

CVE-2026-100209,CVE-2026-100210,CVE-2026-100211,CVE-2026-97739,CVE-2026-97745,CVE-2026-97755,CVE-2026-97759,CVE-2026-97765,CVE-2026-97778,CVE-2026-97741,CVE-2026-97742,CVE-2026-97753,CVE-2026-97756,CVE-2026-97758,CVE-2026-97761,CVE-2026-97767,CVE-2026-97776, andCVE-2026-97780are remote code execution vulnerabilities that affect Microsoft Office Excel. Each has a CVSS base score of 8.8.CVE-2026-100209,CVE-2026-100211,CVE-2026-97745, andCVE-2026-97759involve Use After Free.CVE-2026-100210,CVE-2026-97765,CVE-2026-97756,CVE-2026-97758,CVE-2026-97776, andCVE-2026-97780involve Heap-based Buffer Overflow.CVE-2026-97739involves Heap-based Buffer Overflow and Integer Underflow (Wrap or Wraparound).CVE-2026-97755involves Out-of-bounds Read.CVE-2026-97778involves Integer Overflow or Wraparound.CVE-2026-97741involves Heap-based Buffer Overflow and Off-by-one Error.CVE-2026-97742involves Stack-based Buffer Overflow.CVE-2026-97753involves Heap-based Buffer Overflow and Integer Overflow or Wraparound.CVE-2026-97761involves Stack-based Buffer Overflow.CVE-2026-97767involves Double Free and NULL Pointer Dereference.

CVE-2026-100215is a remote code execution vulnerability that affects Microsoft Graphics Component. The shared weakness is Heap-based Buffer Overflow. The vulnerability has a CVSS base score of 7.8.

CVE-2026-100219andCVE-2026-105016are remote code execution vulnerabilities that affect Microsoft QUIC. Each has a CVSS base score of 9.8.CVE-2026-100219involves Use After Free.CVE-2026-105016involves Heap-based Buffer Overflow.

CVE-2026-100220is a remote code execution vulnerability that affects Windows Media Video Decoder. The shared weakness is Heap-based Buffer Overflow. The vulnerability has a CVSS base score of 8.8.

CVE-2026-102211,CVE-2026-88074,CVE-2026-108130,CVE-2026-108471, andCVE-2026-96914are elevation of privilege vulnerabilities that affect Windows Virtualization-Based Security (VBS) Enclave.CVE-2026-102211involves Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') and Use After Free; has a CVSS base score of 7.0.CVE-2026-88074involves Integer Overflow or Wraparound; has a CVSS base score of 7.8.CVE-2026-108130involves Heap-based Buffer Overflow; has a CVSS base score of 7.8.CVE-2026-108471involves Untrusted Pointer Dereference; has a CVSS base score of 8.8.CVE-2026-96914involves Heap-based Buffer Overflow and Integer Overflow or Wraparound; has a CVSS base score of 8.8.

CVE-2026-102225andCVE-2026-97814are remote code execution vulnerabilities that affect Windows Text Shaping.CVE-2026-102225involves Numeric Truncation Error and Out-of-bounds Read; has a CVSS base score of 8.8.CVE-2026-97814involves Heap-based Buffer Overflow; has a CVSS base score of 9.8.

CVE-2026-102855,CVE-2026-102856, andCVE-2026-102857are remote code execution vulnerabilities that affect Microsoft Office Visio. The shared weakness is Heap-based Buffer Overflow. Each has a CVSS base score of 8.8.CVE-2026-102856involves Integer Overflow or Wraparound.CVE-2026-102857involves Off-by-one Error.

CVE-2026-102866is an elevation of privilege vulnerability that affects Microsoft Office SharePoint. The shared weakness is Improper Verification of Cryptographic Signature. The vulnerability has a CVSS base score of 8.1.

CVE-2026-62840is an elevation of privilege vulnerability that affects Linux Kernel. The shared weakness is Time-of-check Time-of-use (TOCTOU) Race Condition. The vulnerability has a CVSS base score of 7.0.

CVE-2026-69802is a remote code execution vulnerability that affects Network Device Enrollment Service (NDES). The shared weakness is Weak Authentication. The vulnerability has a CVSS base score of 8.1.

CVE-2026-70147,CVE-2026-70153, andCVE-2026-108467are remote code execution vulnerabilities that affect Microsoft PostScript Printer Driver. The shared weakness is Heap-based Buffer Overflow.CVE-2026-70147has a CVSS base score of 9.8.CVE-2026-70153has a CVSS base score of 9.8.CVE-2026-108467has a CVSS base score of 8.8.

CVE-2026-70187is a remote code execution vulnerability that affects Windows Remote Desktop Services. The shared weakness is Use After Free. The vulnerability has a CVSS base score of 8.1.

CVE-2026-70250is a remote code execution vulnerability that affects Windows DHCP Client. The shared weakness is Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') and Use After Free. The vulnerability has a CVSS base score of 8.8.

CVE-2026-83934is a remote code execution vulnerability that affects Windows GDI+. The shared weakness is Stack-based Buffer Overflow. The vulnerability has a CVSS base score of 8.8.

CVE-2026-88073is an elevation of privilege vulnerability that affects Windows Graphics Kernel. The shared weakness is Use After Free. The vulnerability has a CVSS base score of 8.8.

CVE-2026-88117,CVE-2026-88119,CVE-2026-88120,CVE-2026-88171, andCVE-2026-96934are remote code execution vulnerabilities that affect Windows DHCP Server.CVE-2026-88117,CVE-2026-88119, andCVE-2026-88120involve Use After Free; each has a CVSS base score of 8.1.CVE-2026-88171involves Double Free; has a CVSS base score of 8.1.CVE-2026-96934involves Use After Free; has a CVSS base score of 9.8.

CVE-2026-96222andCVE-2026-108131are spoofing vulnerabilities that affect Active Directory Federation Services (AD FS).CVE-2026-96222involves Improper Certificate Validation; has a CVSS base score of 7.4.CVE-2026-108131has a CVSS base score of 7.5.

CVE-2026-96913is an elevation of privilege vulnerability that affects Windows Kernel. The shared weakness is Heap-based Buffer Overflow. The vulnerability has a CVSS base score of 8.8.

CVE-2026-96952is a remote code execution vulnerability that affects Microsoft Windows Media Foundation. The shared weakness is Heap-based Buffer Overflow. The vulnerability has a CVSS base score of 8.8.

CVE-2026-105718is a remote code execution vulnerability that affects Microsoft Excel. The shared weakness is Improper Input Validation and Out-of-bounds Read. The vulnerability has a CVSS base score of 8.8.

CVE-2026-108400is a remote code execution vulnerability that affects HEVC Video Extensions. The shared weakness is Integer Overflow or Wraparound. The vulnerability has a CVSS base score of 8.8.

CVE-2026-108457is a remote code execution vulnerability that affects Microsoft Windows PDF. The shared weakness is Out-of-bounds Write. The vulnerability has a CVSS base score of 8.1.

CVE-2026-108460is a remote code execution vulnerability that affects Windows Message Queuing. The shared weakness is Use After Free. The vulnerability has a CVSS base score of 8.1.

CVE-2026-70215,CVE-2026-88144,CVE-2026-88178, andCVE-2026-88207are remote code execution vulnerabilities that affect Microsoft Office PowerPoint.CVE-2026-70215andCVE-2026-88144involve Use After Free; has a CVSS base score of 8.8.CVE-2026-88178involves Use After Free; has a CVSS base score of 9.8.CVE-2026-88207involves Heap-based Buffer Overflow; has a CVSS base score of 7.5.

CVE-2026-70242,CVE-2026-70291,CVE-2026-88156,CVE-2026-97016, andCVE-2026-97749are remote code execution vulnerabilities that affect Microsoft Office Outlook. Each has a CVSS base score of 9.8.CVE-2026-70242,CVE-2026-70291, andCVE-2026-97016involve Heap-based Buffer Overflow.CVE-2026-88156involves Stack-based Buffer Overflow.CVE-2026-97749involves Double Free.

CVE-2026-70269andCVE-2026-70300are remote code execution vulnerabilities that affect Microsoft Office Word.CVE-2026-70269involves Heap-based Buffer Overflow and Integer Overflow or Wraparound; has a CVSS base score of 8.1.CVE-2026-70300involves Untrusted Pointer Dereference; has a CVSS base score of 9.8.

CVE-2026-83917is an elevation of privilege vulnerability that affects Windows ALPC. The shared weakness is Use After Free. The vulnerability has a CVSS base score of 7.0.

CVE-2026-94510is an elevation of privilege vulnerability that affects Microsoft Bookings. The shared weakness is Authorization Bypass Through User-Controlled Key. The vulnerability has a CVSS base score of 9.9.

CVE-2026-96202andCVE-2026-96943are remote code execution vulnerabilities that affect Windows Raw Image Extension. The shared weakness is Heap-based Buffer Overflow. Each has a CVSS base score of 8.8.CVE-2026-96943involves Integer Overflow or Wraparound.

CVE-2026-96207is an elevation of privilege vulnerability that affects Microsoft Partner Center. The shared weakness is Improper Certificate Validation. The vulnerability has a CVSS base score of 10.0.

Microsoft considers exploitation of the following vulnerabilities unlikely.

CVE-2026-69789is a remote code execution vulnerability that affects Windows Reliable Multicast Transport Driver (RMCAST). The shared weakness is Heap-based Buffer Overflow. The vulnerability has a CVSS base score of 7.5.

CVE-2026-88174is a remote code execution vulnerability that affects Windows Deployment Services. The shared weakness is Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'). The vulnerability has a CVSS base score of 8.1.

CVE-2026-88185is a remote code execution vulnerability that affects Microsoft Office Word. The shared weakness is Heap-based Buffer Overflow. The vulnerability has a CVSS base score of 8.1.

Other critical vulnerabilities

CVE-2026-69435is an elevation of privilege vulnerability that affects Azure SRE Agent. The shared weakness is Server-Side Request Forgery (SSRF). The vulnerability has a CVSS base score of 9.6.

CVE-2026-77900is a remote code execution vulnerability that affects Azure App Service. The shared weakness is Missing Authentication for Critical Function. The vulnerability has a CVSS base score of 9.8.

CVE-2026-83943is an information disclosure vulnerability that affects Azure API Center. The vulnerability has a CVSS base score of 8.7.

CVE-2026-83947is a spoofing vulnerability that affects Azure Event Grid. The shared weakness is Missing Authorization. The vulnerability has a CVSS base score of 7.7.

CVE-2026-88131is a remote code execution vulnerability that affects Microsoft Dataverse. The shared weakness is Deserialization of Untrusted Data. The vulnerability has a CVSS base score of 9.8.

Talos would also like to highlight the following "important" vulnerabilities as Microsoft has determined that their exploitation is "more likely:"

CVE-2026-100214: Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability

CVE-2026-102217: WebDAV Elevation of Privilege Vulnerability

CVE-2026-69673: Windows Update Elevation of Privilege Vulnerability

CVE-2026-69718: Windows Update Elevation of Privilege Vulnerability

CVE-2026-69733: Windows Update Elevation of Privilege Vulnerability

CVE-2026-69783: Windows Update Elevation of Privilege Vulnerability

CVE-2026-69882: Windows Update Elevation of Privilege Vulnerability

CVE-2026-69923: Windows AI Elevation of Privilege Vulnerability

CVE-2026-69926: Desktop Window Manager Elevation of Privilege Vulnerability

CVE-2026-70054: Windows NetBIOS Elevation of Privilege Vulnerability

CVE-2026-70060: Windows Win32k Elevation of Privilege Vulnerability

CVE-2026-70076: Windows Win32k Elevation of Privilege Vulnerability

CVE-2026-70104: Windows Win32k Elevation of Privilege Vulnerability

CVE-2026-70108: Windows Win32k Elevation of Privilege Vulnerability

CVE-2026-70117: Windows Win32k Elevation of Privilege Vulnerability

CVE-2026-70132: Windows Portable Device File System Driver Elevation of Privilege Vulnerability

CVE-2026-70144: Windows Win32k Elevation of Privilege Vulnerability

CVE-2026-70156: Microsoft Windows Search Component Elevation of Privilege Vulnerability

CVE-2026-70218: Windows StateRepository API Elevation of Privilege Vulnerability

CVE-2026-70223: Windows Console Driver Elevation of Privilege Vulnerability

CVE-2026-70233: Windows Common Log File System Driver Elevation of Privilege Vulnerability

CVE-2026-70236: Windows Win32k Elevation of Privilege Vulnerability

CVE-2026-70237: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

CVE-2026-70241: Windows Kerberos Elevation of Privilege Vulnerability

CVE-2026-70245: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

CVE-2026-70249: Windows Win32k Elevation of Privilege Vulnerability

CVE-2026-70253: Windows Win32k Elevation of Privilege Vulnerability

CVE-2026-70255: Desktop Window Manager Elevation of Privilege Vulnerability

CVE-2026-70271: Windows Win32k Elevation of Privilege Vulnerability

CVE-2026-70273: Windows Win32k Elevation of Privilege Vulnerability

CVE-2026-70286: Windows Graphics Component Elevation of Privilege Vulnerability

CVE-2026-70303: Windows Kernel Elevation of Privilege Vulnerability

CVE-2026-72955: Windows Application Compatibility Cache Elevation of Privilege Vulnerability

CVE-2026-81971: Windows NTFS Elevation of Privilege Vulnerability

CVE-2026-83505: Windows Setup Files Cleanup Elevation of Privilege Vulnerability

CVE-2026-83509: Windows Setup Files Cleanup Elevation of Privilege Vulnerability

CVE-2026-83510: Windows Setup Files Cleanup Elevation of Privilege Vulnerability

CVE-2026-83580: Windows Client-Side Caching (CSC) Service Elevation of Privilege Vulnerability

CVE-2026-83669: Windows Error Reporting Elevation of Privilege Vulnerability

CVE-2026-83699: Windows Client-Side Caching (CSC) Service Elevation of Privilege Vulnerability

CVE-2026-83704: Microsoft Windows Search Component Elevation of Privilege Vulnerability

CVE-2026-83717: Windows Installer Elevation of Privilege Vulnerability

CVE-2026-83724: Windows Management Instrumentation Elevation of Privilege Vulnerability

CVE-2026-83732: Win32k Elevation of Privilege Vulnerability

CVE-2026-83735: Windows Kernel Elevation of Privilege Vulnerability

CVE-2026-83738: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

CVE-2026-83750: Windows Error Reporting Elevation of Privilege Vulnerability

CVE-2026-83761: Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability

CVE-2026-83763: Windows Input System Elevation of Privilege Vulnerability

CVE-2026-83768: Windows Kernel Elevation of Privilege Vulnerability

CVE-2026-83769: Microsoft OpenSSH for Windows Elevation of Privilege Vulnerability

CVE-2026-83793: Windows Update Orchestrator Service Elevation of Privilege Vulnerability

CVE-2026-83830: Windows COM+ Event System Service Elevation of Privilege Vulnerability

CVE-2026-83834: Windows Kernel-Mode Drivers Elevation of Privilege Vulnerability

CVE-2026-83840: Windows Error Reporting Elevation of Privilege Vulnerability

CVE-2026-83842: Windows TCP/IP Elevation of Privilege Vulnerability

CVE-2026-83848: Windows COM+ Event System Service Elevation of Privilege Vulnerability

CVE-2026-83867: Windows Push Notifications Elevation of Privilege Vulnerability

CVE-2026-83886: Windows Update Orchestrator Service Elevation of Privilege Vulnerability

CVE-2026-83896: Windows Direct Composition Elevation of Privilege Vulnerability

CVE-2026-83899: Windows Installer Elevation of Privilege Vulnerability

CVE-2026-83902: Windows Direct Composition Elevation of Privilege Vulnerability

CVE-2026-83921: Windows Search Service Elevation of Privilege Vulnerability

CVE-2026-84014: Windows Device Association Service Elevation of Privilege Vulnerability

CVE-2026-85355: Windows Common Log File System Driver Elevation of Privilege Vulnerability

CVE-2026-85791: Windows Encrypting File System (EFS) Elevation of Privilege Vulnerability

CVE-2026-85802: Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability

CVE-2026-85804: Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability

CVE-2026-85832: Windows Background Intelligent Transfer Service (BITS) Elevation of Privilege Vulnerability

CVE-2026-85843: Windows Background Intelligent Transfer Service (BITS) Elevation of Privilege Vulnerability

CVE-2026-85848: Windows Background Intelligent Transfer Service (BITS) Elevation of Privilege Vulnerability

CVE-2026-85849: Windows AppX Deployment Service Elevation of Privilege Vulnerability

CVE-2026-85850: Windows Kernel Elevation of Privilege Vulnerability

CVE-2026-85855: Windows DWM Core Library Elevation of Privilege Vulnerability

CVE-2026-85870: Windows Common Log File System Driver Elevation of Privilege Vulnerability

CVE-2026-85901: Windows Graphics Component Elevation of Privilege Vulnerability

CVE-2026-85908: Windows Graphics Component Elevation of Privilege Vulnerability

CVE-2026-85941: Windows Installer Elevation of Privilege Vulnerability

CVE-2026-85945: Windows Kernel Elevation of Privilege Vulnerability

CVE-2026-88118: Windows Background Intelligent Transfer Service (BITS) Elevation of Privilege Vulnerability

CVE-2026-88133: Windows Portable Device Enumerator Service Elevation of Privilege Vulnerability

CVE-2026-88147: Windows Secure Socket Tunneling Protocol (SSTP) Elevation of Privilege Vulnerability

CVE-2026-88152: Windows Background Intelligent Transfer Service (BITS) Elevation of Privilege Vulnerability

CVE-2026-88159: Windows Background Intelligent Transfer Service (BITS) Remote Code Execution Vulnerability

CVE-2026-88191: Microsoft Windows Search Component Elevation of Privilege Vulnerability

CVE-2026-96858: Windows Security Account Manager Tampering Vulnerability

CVE-2026-96911: Microsoft Windows Search Component Elevation of Privilege Vulnerability

CVE-2026-96929: Windows Kernel Elevation of Privilege Vulnerability

CVE-2026-96940: Microsoft Exchange Server Elevation of Privilege Vulnerability

CVE-2026-69452: Windows Enterprise App Management Elevation of Privilege Vulnerability

CVE-2026-69880: Desktop Window Manager Elevation of Privilege Vulnerability

CVE-2026-69918: Windows Core Messaging Elevation of Privilege Vulnerability

CVE-2026-70103: Windows Error Reporting Elevation of Privilege Vulnerability

CVE-2026-70106: Windows Kernel Elevation of Privilege Vulnerability

CVE-2026-70151: Windows Direct Composition Elevation of Privilege Vulnerability

CVE-2026-70176: Windows Win32k Elevation of Privilege Vulnerability

CVE-2026-70279: Microsoft Exchange Server Spoofing Vulnerability

CVE-2026-83785: Windows COM+ Event System Service Elevation of Privilege Vulnerability

CVE-2026-83927: Windows Registry Elevation of Privilege Vulnerability

CVE-2026-85884: Windows Health and Optimized Experiences Service Elevation of Privilege Vulnerability

CVE-2026-85902: Windows Direct Composition Elevation of Privilege Vulnerability

CVE-2026-85906: Windows Direct Composition Elevation of Privilege Vulnerability

CVE-2026-88093: Desktop Window Manager Elevation of Privilege Vulnerability

CVE-2026-96939: Servicing Stack Updates Elevation of Privilege Vulnerability

CVE-2026-97798: Windows Error Reporting Service Elevation of Privilege Vulnerability

CVE-2026-97799: Windows Audio Service Elevation of Privilege Vulnerability

CVE-2026-97800: Windows Mobile Broadband Elevation of Privilege Vulnerability

A complete list of all the other vulnerabilities Microsoft disclosed this month is available on itsupdate page.

In response to these vulnerability disclosures, Talos is releasing a new Snort ruleset that detects attempts to exploit some of them. Please note that additional rules may be released at a future date, and current rules are subject to change pending additional information. Cisco Secure Firewall customers should use the latest update to their ruleset by updating their SRU. Open-source Snort Subscriber Ruleset customers can stay up to date by downloading the latest rule pack available for purchase onSnort.org.

Snort 2 rule coverage: 1:67210 - 1:67273, 1:67276 - 1:67279, 1:67282 - 1:67311, 1:67313 - 1:67316, 1:67319 - 1:67322

Snort 3 rule coverage: 1:301663 - 1:301694, 1:301696, 1:301702 - 1:301703, 1:301705 - 1:301706, 1:301709, 1:301711, 1:301717 - 1:301718

Microsoft has released its monthly security update for September 2026, which includes 973 vulnerabilities affecting a range of products, including 113 that Microsoft marked as "critical."

Microsoft has released its monthly security update for August 2026, which includes 421 vulnerabilities affecting a range of products, including 62 that Microsoft marked as "critical."

Microsoft has released its monthly security update for July 2026, which includes 622 vulnerabilities affecting a range of products, including 57 that Microsoft marked as "critical."