Microsoft Patch Tuesday for October 2026 , Snort rules and prominent vulnerabilities

[Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabili]

• Security Resources - [x]

Tuesday, October 13, 2026 16:37

Microsoft has released its monthly security update for October 2026, which includes 1415 vulnerabilities affecting a range of products, including 85 that Microsoft marked as "critical."

Microsoft notes that 1 of the vulnerabilities disclosed this month have been exploited in the wild

_CVE-2026-96951_ is a security feature bypass vulnerability that affects Windows Shell. The shared weakness is Improper Neutralization of Special Elements used in a Command ('Command Injection'). The vulnerability has a CVSS base score of 8.8.

Out of 85 "critical" vulnerabilities, 67 are remote code execution (RCE) vulnerabilities.

Microsoft considers exploitation of the following vulnerabilities more likely.

_CVE-2026-70229_ is a remote code execution vulnerability that affects Windows Active Directory Domain Services. The shared weakness is Incorrect Authorization. The vulnerability has a CVSS base score of 8.1.

_CVE-2026-70571_ is a remote code execution vulnerability that affects Microsoft Exchange Server. The shared weakness is Stack-based Buffer Overflow. The vulnerability has a CVSS base score of 8.1.

Microsoft considers exploitation of the following vulnerabilities less likely.

_CVE-2026-100202_ is a remote code execution vulnerability that affects Windows Message Queuing Queue Manager. The shared weakness is Use After Free. The vulnerability has a CVSS base score of 9.8.

_CVE-2026-100215_ is a remote code execution vulnerability that affects Microsoft Graphics Component. The shared weakness is Heap-based Buffer Overflow. The vulnerability has a CVSS base score of 7.8.

_CVE-2026-100220_ is a remote code execution vulnerability that affects Windows Media Video Decoder. The shared weakness is Heap-based Buffer Overflow. The vulnerability has a CVSS base score of 8.8.

_CVE-2026-102866_ is an elevation of privilege vulnerability that affects Microsoft Office SharePoint. The shared weakness is Improper Verification of Cryptographic Signature. The vulnerability has a CVSS base score of 8.1.

_CVE-2026-62840_ is an elevation of privilege vulnerability that affects Linux Kernel. The shared weakness is Time-of-check Time-of-use (TOCTOU) Race Condition. The vulnerability has a CVSS base score of 7.0.

_CVE-2026-69802_ is a remote code execution vulnerability that affects Network Device Enrollment Service (NDES). The shared weakness is Weak Authentication. The vulnerability has a CVSS base score of 8.1.

_CVE-2026-70187_ is a remote code execution vulnerability that affects Windows Remote Desktop Services. The shared weakness is Use After Free. The vulnerability has a CVSS base score of 8.1.

_CVE-2026-70250_ is a remote code execution vulnerability that affects Windows DHCP Client. The shared weakness is Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') and Use After Free. The vulnerability has a CVSS base score of 8.8.

_CVE-2026-83934_ is a remote code execution vulnerability that affects Windows GDI+. The shared weakness is Stack-based Buffer Overflow. The vulnerability has a CVSS base score of 8.8.

_CVE-2026-88073_ is an elevation of privilege vulnerability that affects Windows Graphics Kernel. The shared weakness is Use After Free. The vulnerability has a CVSS base score of 8.8.

_CVE-2026-96913_ is an elevation of privilege vulnerability that affects Windows Kernel. The shared weakness is Heap-based Buffer Overflow. The vulnerability has a CVSS base score of 8.8.

_CVE-2026-96952_ is a remote code execution vulnerability that affects Microsoft Windows Media Foundation. The shared weakness is Heap-based Buffer Overflow. The vulnerability has a CVSS base score of 8.8.

_CVE-2026-105718_ is a remote code execution vulnerability that affects Microsoft Excel. The shared weakness is Improper Input Validation and Out-of-bounds Read. The vulnerability has a CVSS base score of 8.8.

_CVE-2026-108400_ is a remote code execution vulnerability that affects HEVC Video Extensions. The shared weakness is Integer Overflow or Wraparound. The vulnerability has a CVSS base score of 8.8.

_CVE-2026-108457_ is a remote code execution vulnerability that affects Microsoft Windows PDF. The shared weakness is Out-of-bounds Write. The vulnerability has a CVSS base score of 8.1.

_CVE-2026-108460_ is a remote code execution vulnerability that affects Windows Message Queuing. The shared weakness is Use After Free. The vulnerability has a CVSS base score of 8.1.

_CVE-2026-83917_ is an elevation of privilege vulnerability that affects Windows ALPC. The shared weakness is Use After Free. The vulnerability has a CVSS base score of 7.0.

_CVE-2026-94510_ is an elevation of privilege vulnerability that affects Microsoft Bookings. The shared weakness is Authorization Bypass Through User-Controlled Key. The vulnerability has a CVSS base score of 9.9.

_CVE-2026-96202_ and _CVE-2026-96943_ are remote code execution vulnerabilities that affect Windows Raw Image Extension. The shared weakness is Heap-based Buffer Overflow. Each has a CVSS base score of 8.8. _CVE-2026-96943_ involves Integer Overflow or Wraparound.

_CVE-2026-96207_ is an elevation of privilege vulnerability that affects Microsoft Partner Center. The shared weakness is Improper Certificate Validation. The vulnerability has a CVSS base score of 10.0.

Microsoft considers exploitation of the following vulnerabilities unlikely.

_CVE-2026-69789_ is a remote code execution vulnerability that affects Windows Reliable Multicast Transport Driver (RMCAST). The shared weakness is Heap-based Buffer Overflow. The vulnerability has a CVSS base score of 7.5.

_CVE-2026-88174_ is a remote code execution vulnerability that affects Windows Deployment Services. The shared weakness is Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'). The vulnerability has a CVSS base score of 8.1.

_CVE-2026-88185_ is a remote code execution vulnerability that affects Microsoft Office Word. The shared weakness is Heap-based Buffer Overflow. The vulnerability has a CVSS base score of 8.1.

_CVE-2026-69435_ is an elevation of privilege vulnerability that affects Azure SRE Agent. The shared weakness is Server-Side Request Forgery (SSRF). The vulnerability has a CVSS base score of 9.6.

_CVE-2026-77900_ is a remote code execution vulnerability that affects Azure App Service. The shared weakness is Missing Authentication for Critical Function. The vulnerability has a CVSS base score of 9.8.

_CVE-2026-83943_ is an information disclosure vulnerability that affects Azure API Center. The vulnerability has a CVSS base score of 8.7.

_CVE-2026-83947_ is a spoofing vulnerability that affects Azure Event Grid. The shared weakness is Missing Authorization. The vulnerability has a CVSS base score of 7.7.

_CVE-2026-88131_ is a remote code execution vulnerability that affects Microsoft Dataverse. The shared weakness is Deserialization of Untrusted Data. The vulnerability has a CVSS base score of 9.8.

Talos would also like to highlight the following "important" vulnerabilities as Microsoft has determined that their exploitation is "more likely:"

_CVE-2026-100214_: Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability

_CVE-2026-70132_: Windows Portable Device File System Driver Elevation of Privilege Vulnerability

_CVE-2026-70156_: Microsoft Windows Search Component Elevation of Privilege Vulnerability

_CVE-2026-70233_: Windows Common Log File System Driver Elevation of Privilege Vulnerability

_CVE-2026-70237_: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

_CVE-2026-70245_: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

_CVE-2026-72955_: Windows Application Compatibility Cache Elevation of Privilege Vulnerability

_CVE-2026-83580_: Windows Client-Side Caching (CSC) Service Elevation of Privilege Vulnerability

_CVE-2026-83699_: Windows Client-Side Caching (CSC) Service Elevation of Privilege Vulnerability

_CVE-2026-83704_: Microsoft Windows Search Component Elevation of Privilege Vulnerability

_CVE-2026-83724_: Windows Management Instrumentation Elevation of Privilege Vulnerability

_CVE-2026-83738_: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

_CVE-2026-83793_: Windows Update Orchestrator Service Elevation of Privilege Vulnerability

_CVE-2026-83830_: Windows COM+ Event System Service Elevation of Privilege Vulnerability

_CVE-2026-83848_: Windows COM+ Event System Service Elevation of Privilege Vulnerability

_CVE-2026-83886_: Windows Update Orchestrator Service Elevation of Privilege Vulnerability

_CVE-2026-84014_: Windows Device Association Service Elevation of Privilege Vulnerability

_CVE-2026-85355_: Windows Common Log File System Driver Elevation of Privilege Vulnerability

_CVE-2026-85791_: Windows Encrypting File System (EFS) Elevation of Privilege Vulnerability

_CVE-2026-85832_: Windows Background Intelligent Transfer Service (BITS) Elevation of Privilege Vulnerability

_CVE-2026-85843_: Windows Background Intelligent Transfer Service (BITS) Elevation of Privilege Vulnerability

_CVE-2026-85848_: Windows Background Intelligent Transfer Service (BITS) Elevation of Privilege Vulnerability

_CVE-2026-85870_: Windows Common Log File System Driver Elevation of Privilege Vulnerability

_CVE-2026-88118_: Windows Background Intelligent Transfer Service (BITS) Elevation of Privilege Vulnerability

_CVE-2026-88133_: Windows Portable Device Enumerator Service Elevation of Privilege Vulnerability

_CVE-2026-88147_: Windows Secure Socket Tunneling Protocol (SSTP) Elevation of Privilege Vulnerability

_CVE-2026-88152_: Windows Background Intelligent Transfer Service (BITS) Elevation of Privilege Vulnerability

_CVE-2026-88159_: Windows Background Intelligent Transfer Service (BITS) Remote Code Execution Vulnerability

_CVE-2026-88191_: Microsoft Windows Search Component Elevation of Privilege Vulnerability

_CVE-2026-96911_: Microsoft Windows Search Component Elevation of Privilege Vulnerability

_CVE-2026-69452_: Windows Enterprise App Management Elevation of Privilege Vulnerability

_CVE-2026-83785_: Windows COM+ Event System Service Elevation of Privilege Vulnerability

_CVE-2026-85884_: Windows Health and Optimized Experiences Service Elevation of Privilege Vulnerability

A complete list of all the other vulnerabilities Microsoft disclosed this month is available on its _update page_.

In response to these vulnerability disclosures, Talos is releasing a new Snort ruleset that detects attempts to exploit some of them. Please note that additional rules may be released at a future date, and current rules are subject to change pending additional information. Cisco Secure Firewall customers should use the latest update to their ruleset by updating their SRU. Open-source Snort Subscriber Ruleset customers can stay up to date by downloading the latest rule pack available for purchase on _Snort.org_.

Snort 2 rule coverage: 1:67210 - 1:67273, 1:67276 - 1:67279, 1:67282 - 1:67311, 1:67313 - 1:67316, 1:67319 - 1:67322

Snort 3 rule coverage: 1:301663 - 1:301694, 1:301696, 1:301702 - 1:301703, 1:301705 - 1:301706, 1:301709, 1:301711, 1:301717 - 1:301718

• * ###### Security Resources

• * ###### Media

• * ###### Support

• * ###### Company