---
title: October 2026 Patch Tuesday: criticals to prioritize after the zero-day | ctxsec
url: https://ctxsec.com/items/pt-2026-10
description: ""
status: "confirmed"
published: 2026-10-13
---

> 

[← Cybersecurity News](/news) · [markdown](/items/pt-2026-10.md)

confirmed

2026-10-13

### October 2026 Patch Tuesday: criticals to prioritize after the zero-day

Record-scale Microsoft release (reporting outlets cite ~1,411–1,419 Microsoft CVEs depending on counting). Actively exploited: Windows Shell MotW bypass CVE-2026-96951 (CVSS 8.8, CISA KEV due Oct 16). Publicly disclosed before patch (not known exploited per Microsoft/SANS): .NET Framework WDAC bypass CVE-2026-108398 and MessagePack-CSharp DoS CVE-2026-92707. High-value not-known-exploited: Exchange RCE CVE-2026-70571 (8.1) and AD Domain Services RCE CVE-2026-70229 (8.1), both 'Exploitation More Likely'; Outlook RCEs (e.g. CVE-2026-70242); Message Queuing RCE CVE-2026-100202 (9.8). Severity and exploitability labels are Microsoft's.

Sources: [MSRC release notes](https://msrc.microsoft.com/update-guide/releaseNote/2026-Oct) · [NVD CVE-2026-70571](https://nvd.nist.gov/vuln/detail/CVE-2026-70571) · [NVD CVE-2026-70229](https://nvd.nist.gov/vuln/detail/CVE-2026-70229) · [NVD CVE-2026-70242](https://nvd.nist.gov/vuln/detail/CVE-2026-70242) · [NVD CVE-2026-100202](https://nvd.nist.gov/vuln/detail/CVE-2026-100202) · [SANS ISC Patch Tuesday](https://isc.sans.edu/diary/0) · [ZDI October review](https://www.zerodayinitiative.com/blog/2026/10/13/the-october-2026-security-update-review)