Global – October 13, 2026 -- Microsoft's October 2026 security release includes an actively exploited Windows Shell zero-day (CVE-2026-96951, CVSS 8.8), 20 Critical remote code execution flaws in Office applications and five CVSS 9.8 vulnerabilities in Outlook. Several of the flaws can be triggered by viewing a file or email in a preview pane, which removes the click-to-compromise barrier many enterprises rely on.
Windows Shell zero-day strips Mark of the Web protections in live attacks
CVE-2026-96951 is an Important security feature bypass that Microsoft confirms is being exploited in the wild. It lets an attacker evade Mark of the Web (MOTW), the trust tag that triggers Protected View in Office and SmartScreen warnings for downloaded executables. Once the tag is stripped, SmartScreen, Office Protected View and Application Guard no longer apply.
Exploitation requires a user to open or click a crafted file delivered by email, instant message or web download. Windows Shell is present on every Windows endpoint, so the exposed population is effectively the entire Windows install base.
Six Office flaws fire from the Preview Pane, led by a CVSS 9.8 PowerPoint bug
The release includes 20 Critical RCE vulnerabilities across Excel, PowerPoint, Visio and Word, with CVSS scores from 7.5 to 9.8. Six list the Preview Pane as an attack vector, all in PowerPoint or Word: CVE-2026-88178 (PowerPoint, 9.8), CVE-2026-70215 and CVE-2026-88144 (PowerPoint, 8.8), CVE-2026-70269 and CVE-2026-88185 (Word, 8.1), and CVE-2026-88207 (PowerPoint, 7.5).
CVE-2026-88178 is the most severe. Microsoft states an unauthenticated attacker could exploit it by submitting a crafted presentation to an affected Office Online service, with no user interaction. The other 14 are 11 Excel and three Visio flaws, all rated CVSS 8.8, and Microsoft says the Preview Pane is not an attack vector for any of them.
Five Outlook flaws at CVSS 9.8 expose every mailbox
CVE-2026-70242, CVE-2026-70291, CVE-2026-88156, CVE-2026-97016 and CVE-2026-97749 are Critical RCE vulnerabilities in Outlook, each scoring 9.8. They include heap-based buffer overflows (CWE-122), a stack-based buffer overflow (CWE-121) and a double free (CWE-415), all reachable over the network without authentication.
Microsoft lists the Preview Pane as an attack vector for CVE-2026-70291 and CVE-2026-88156. Merely viewing a crafted email in the Reading Pane could trigger code execution. Outlook runs in the logged-in user's context, so an attacker gains that user's credentials, cached tokens and resource access. Disabling the Reading Pane carries a productivity cost that many enterprises do not accept.
Fifteen unauthenticated network RCE flaws hit DHCP, QUIC, printing and PDF components
Fifteen CVEs allow unauthenticated, network-reachable code execution across DHCP Server, Microsoft QUIC, the PostScript Printer Driver and PDF handling. DHCP servers sit on internal networks by design and trust inbound requests from any client asking for an address. CVE-2026-100219 and CVE-2026-105016 in Microsoft QUIC expose any service using QUIC transport.
Active Directory flaws put domain controllers and federated trust at risk
CVE-2026-70229 in Active Directory Domain Services enables RCE against domain controllers. CVE-2026-108131 and CVE-2026-96222 in Active Directory Federation Services are spoofing flaws that could enable federated authentication bypass. Compromise of these components can spread across an entire domain or break trust boundaries between federated identity providers.
Publicly disclosed .NET Framework bug bypasses Windows Defender Application Control
CVE-2026-108398 is an Important security feature bypass (CVSS 8.8) that Microsoft confirms was publicly disclosed. An authenticated local attacker can place a crafted .NET assembly on a system and register it for loading by a protected process. That bypasses Windows Defender Application Control (WDAC) enforcement and requires no user interaction.
The flaw matters most on administrative workstations, kiosks and hardened servers that use WDAC as a compensating control. It turns a local authenticated foothold into unrestricted code execution despite allowlist policy.
MessagePack-CSharp memory exhaustion flaw threatens API availability
CVE-2026-92707 is a publicly disclosed Moderate denial of service flaw (CVSS 5.3) in the MessagePack-CSharp serialization library. An unauthenticated attacker can exhaust memory over the network with crafted payloads, because sequential memory allocation is improperly controlled. Web APIs, microservices and message queue consumers that deserialize untrusted input are exposed. The library ships as a NuGet dependency, so affected deployments may not appear in OS-level inventory.