October 2026 Patch Tuesday: 1,413 CVEs Include Three Zero

Reporting by CrowdStrike BlogRead the original at crowdstrike.com

Executive Summary

The release details numerous critical and high-severity vulnerabilities across Microsoft applications, network services, and operating system components. A significant attack surface exists through preview pane exploitation in Office applications like Excel, PowerPoint, and Word, allowing remote code execution without user interaction. Unauthenticated Remote Code Execution (RCE) flaws are present in several core infrastructure components, including the Windows DHCP Server, QUIC, PostScript Printer Driver, Message Queuing Queue Manager, and Microsoft Outlook. Furthermore, vulnerabilities exist within identity platform components affecting Active Directory Domain Services and Federation Services, alongside critical flaws in the Windows Kernel, Hyper-V, and .NET Framework. A specific zero-day vulnerability exists in the Windows Shell that bypasses security features like Mark of the Web defenses.

Facts Only

* Preview Pane-triggered exploitation dominates Office applications (Excel, PowerPoint, Visio) with 23 CVEs.
* Unauthenticated network-reachable RCE vulnerabilities exist across DHCP Server, QUIC, PostScript Printer Driver, and PDF handling components.
* RCE and spoofing flaws affect Active Directory Domain Services (AD DS) and Active Directory Federation Services (AD FS).
* Microsoft Outlook has five critical RCE vulnerabilities, including CVE-2026-70242 and CVE-2026-70291.
* CVE-2026-96951 is a security feature bypass vulnerability in Windows Shell with a CVSS score of 8.8.
* CVE-2026-108398 is a .NET Framework security feature bypass vulnerability with a CVSS score of 8.8, allowing execution within WDAC-protected processes without user interaction.
* CVE-2026-92707 is a denial of service vulnerability in MessagePack-CSharp with a CVSS score of 5.3.
* Critical RCE vulnerabilities exist in Microsoft Office (Excel, PowerPoint, Visio, Word), including CVEs with CVSS scores up to 9.8.
* Critical RCE vulnerabilities exist in Microsoft Outlook (e.g., CVE-2026-70242, CVE-2026-70291) with CVSS scores of 9.8.
* Critical RCE vulnerabilities exist in Microsoft QUIC (CVE-2026-100219, CVE-2026-105016) with CVSS scores of 9.8.
* Critical RCE vulnerabilities exist in the Microsoft PostScript Printer Driver (CVE-2026-70147, CVE-2026-70153) with CVSS scores of 9.8.
* A Critical RCE vulnerability exists in Windows DHCP Server (CVE-2026-96934) with a CVSS score of 9.8.
* A Critical RCE vulnerability exists in Windows Message Queuing Queue Manager (CVE-2026-100202) with a CVSS score of 9.8.
* A Critical RCE vulnerability exists in Windows Text Shaping (CVE-2026-97814) with a CVSS score of 9.8.
* A Critical RCE vulnerability exists in Windows Raw Image Extension (CVE-2026-21413) with a CVSS score of 9.8.
* Critical RCE vulnerabilities exist in Windows Hyper-V (e.g., CVE-2026-102214, CVE-2026-105733) with CVSS scores of 8.8.
* A Critical elevation of privilege vulnerability exists in the Windows Kernel (CVE-2026-96913) with a CVSS score of 8.8.
* A Critical RCE vulnerability exists in Microsoft Exchange Server (CVE-2026-70571) with a CVSS score of 8.1.
* A Critical RCE vulnerability exists in Windows Remote Desktop Services (CVE-2026-70187) with a CVSS score of 8.1.

Full Take

The prevalence of vulnerabilities that enable code execution via zero or near-zero user interaction across diverse components—from Office document viewing to network service interactions—highlights a fundamental tension between enterprise security controls and the ubiquity of deployed software. The focus on file parsing flaws in Office applications and raw image extensions suggests that the vast attack surface is defined not by complex, multi-step social engineering, but by exploiting default application behaviors and standard file interaction workflows. This pattern indicates that controls designed to stop user-initiated actions, such as Mark of the Web (MOTW), are actively bypassed when flaws exist in the underlying rendering pipeline, effectively converting expected system behavior into an exploitable vector for initial access brokers.
The critical nature of network-reachable RCEs in infrastructure components like DHCP and QUIC demonstrates that perimeter defenses are insufficient when trust is granted based on network adjacency. The fact that vulnerabilities in systems like Message Queuing Queue Manager and the PostScript Printer Driver allow SYSTEM-level execution over the network underscores the systemic risk embedded within core networking and print services. This suggests a failure in isolating privileged infrastructure, as these services are inherently designed to bridge network boundaries.
The intersection of application-level flaws (Office RCE) and low-level kernel/hypervisor escapes reveals an escalating chain for advanced persistence. When critical components like the Windows Kernel or Hyper-V offer elevation paths based on standard memory corruption bugs, they provide a mechanism to subvert sophisticated security mechanisms like Virtualization-Based Security. The implications point toward a scenario where commodity exploit kits targeting user workflows can be effectively amplified into deep system compromises by exploiting these underlying trust boundary failures. The central question is how systems intended for isolation—virtualization, access controls—can fail when the foundational components are susceptible to unauthenticated memory corruption.
Bridge Questions: If the primary defense against RCE in Office involves monitoring file previews, what alternative, non-user-interaction-based integrity checks could reliably monitor the state of rendered documents? How does the reliance on legacy services like MSMQ and PostScript drivers contribute to systemic risk when they are exposed over modern network infrastructure? What is the organizational cost associated with treating user application interactions as the primary security checkpoint rather than verifying the integrity of the entire file processing pipeline?

From the original · CrowdStrike Blog

October 2026 Attack Surface Analysis Preview Pane-triggered exploitation dominates this release with 23 CVEs across Office applications including Excel, PowerPoint, and Visio.

Read the full story at crowdstrike.com

Sentinel — Human

Confidence

This text appears to be a technical security bulletin or analysis, characterized by highly specific CVE enumeration and structured data, suggesting it is derived from human research rather than pure synthetic generation.

Signals Detected

Sentence length variance is somewhat erratic; specific CVE lists and table structures introduce necessary variation.

The text flows logically from specific technical vulnerabilities to broader attack vectors (e.g., Office $\to$ Outlook $\to$ RCEs) but maintains a highly dense, fact-driven structure.

The consistent use of structured tables and explicit CVE listings suggests direct data compilation rather than pure AI narrative generation.

The detailed, specific enumeration of numerous, highly detailed CVEs with associated CVSS scores and technical descriptions suggests source material fed into a report format.

Human Indicators

The precise cataloging and cross-referencing of numerous, very specific CVEs across various Microsoft components indicate a deep, specialized knowledge base typical of security researchers or analysts compiling data.

The inclusion of contextual commentary, such as discussing the historical attractiveness of certain flaw classes to adversaries (e.g., phishing operators), adds an interpretive layer beyond raw data reporting.