Microsoft’s October 2026 Patch Tuesday, released on October 13, is even larger than September’s record release. It fixes one zero-day that attackers are already exploiting, a Windows Shell security feature bypass that CISA has given federal agencies just three days to patch. It also includes a long list of unauthenticated remote code execution bugs in the network services Windows Server runs: DHCP, DNS, RRAS, Message Queuing, LSASS, Failover Clustering and NPS. If you run Windows servers, patch the zero-day first, then work through exposed services in priority order.
The scope of October 2026 Patch Tuesday
Microsoft lists 1,413 CVEs in its October 2026 release notes, up from 999 in September. Windows accounts for 1,102 of them. Across the Microsoft-assigned CVEs in this release, 76 are rated Critical, and 58 of those are remote code execution bugs.
- Elevation of privilege: 677 CVEs
- Remote code execution: 316 CVEs
- Information disclosure: 254 CVEs
- Server-heavy components: Windows DNS (52 CVEs), SharePoint Server (36), Remote Desktop client and services (30), SQL Server (22), Hyper-V (18), Windows DHCP Server (16), RRAS (13), Exchange Server (7) and Active Directory Domain Services (5)
Exploited and publicly disclosed vulnerabilities
Microsoft marked one vulnerability as “Exploitation Detected” and one as publicly disclosed. CISA added the exploited one to its Known Exploited Vulnerabilities (KEV) catalog on October 13, with a federal remediation deadline of October 16, 2026. That is three days, not the usual two or three weeks.
- CVE-2026-96951: Windows Shell security feature bypass (CVSS 8.8, exploited). A command injection flaw lets an unauthenticated attacker bypass a Windows security feature over the network. The user has to take an action, such as opening a file or link. Affected server versions are Windows Server 2012 R2 through Windows Server 2025, including Server Core.
- CVE-2026-108398: .NET Framework security feature bypass (CVSS 8.8, publicly disclosed). An untrusted search path lets an authorized local attacker bypass a security feature. Microsoft rates exploitation less likely. It affects .NET Framework 3.5 through 4.8.1 on Windows Server 2012 through 2025.
The Windows Shell bug needs someone to interact with malicious content. On servers, that makes it most urgent on hosts where people open files and browse: Remote Desktop session hosts, jump servers, admin workstations and file servers that staff work on directly.
Key CVEs for Windows server teams
By Microsoft’s CVSS scoring, 56 of this month’s remote code execution bugs are network-reachable and need no privileges and no user interaction. These are the ones to watch on servers:
| CVE | Component | Severity / CVSS | Why it matters |
|---|---|---|---|
| CVE-2026-96934, CVE-2026-96320 | Windows DHCP Server RCE | Critical / 9.8 and Important / 9.8 | No authentication needed; infrastructure servers in every site |
| CVE-2026-100202 | Windows Message Queuing RCE | Critical / 9.8 | Only where MSMQ is enabled |
| CVE-2026-96219 | LSASS RCE | Important / 9.8 | Windows Server 2019, 2022 and 2025, including domain controllers |
| CVE-2026-83869, CVE-2026-96113 | Windows DNS RCE | Important / 9.8 | DNS servers, often running on domain controllers |
| CVE-2026-85809, CVE-2026-85792 | RRAS RCE | Important / 9.8 | VPN and edge servers |
| CVE-2026-88102, CVE-2026-96864 | Failover Cluster RCE | Important / 9.8 | Clustered SQL Server, Hyper-V and file servers |
| CVE-2026-100222, CVE-2026-85806 | Network Policy Server RCE | Important / 9.8 | RADIUS and VPN authentication servers |
| CVE-2026-83910 | RPC Runtime RCE | Important / 9.8 | Present on every Windows Server version |
| CVE-2026-70024 | IIS RCE | Important / 9.8 | Web and application servers |
| CVE-2026-70229 | Active Directory Domain Services RCE | Critical / 8.1 | Domain controllers; rated Exploitation More Likely |
Exchange, SharePoint and SQL Server need their own updates. CVE-2026-70571 is a Critical Exchange Server remote code execution bug (CVSS 8.1) that Microsoft rates Exploitation More Likely. CVE-2026-70279 is an Exchange spoofing bug (CVSS 9.3), also rated More Likely. Both affect Exchange Server 2016 CU23, Exchange Server 2019 CU14 and CU15, and Exchange Server Subscription Edition. SharePoint Server receives fixes for 36 CVEs, including CVE-2026-102866, a Critical elevation of privilege bug. SQL Server receives fixes for 22 CVEs, including the remote code execution bugs CVE-2026-94512 and CVE-2026-65674 (both CVSS 8.8). Identity teams should also note CVE-2026-96252, an AD FS spoofing bug (CVSS 9.1).
Windows Update, WSUS and the servicing stack. This month fixes three elevation of privilege bugs in Windows Server Update Services (CVE-2026-81969, CVE-2026-83499 and CVE-2026-105009), seven servicing stack bugs, and seven Windows Update elevation of privilege bugs that Microsoft rates Exploitation More Likely. If you run WSUS, patch the WSUS servers themselves this cycle. Microsoft’s release notes point to ADV990001 for the current servicing stack updates. Before you deploy the cumulative update, check that the servicing stack prerequisites are in place.
Patching priorities for Windows servers
In a release this large, the order you patch in matters more than the total. A practical order of operations:
- Exploited first. Deploy the October cumulative update, which fixes CVE-2026-96951, to the hosts where people open files and links: RDS session hosts, jump servers and admin servers. Aim to meet CISA’s October 16 deadline even if you are not a federal agency.
- Exposed network services. Next patch DHCP, DNS, RRAS, NPS and VPN servers, IIS servers, and any host running optional network services such as MSMQ.
- Identity tier. Patch domain controllers in waves, for the LSASS, AD DS and DNS fixes, so that at least one healthy DC stays up in each site. Include AD FS servers in this tier.
- Application and data tier. SQL Server, Exchange and SharePoint have their own packages. Schedule them separately from the OS update, and patch cluster nodes one at a time.
- Patch infrastructure and the rest. Patch your WSUS servers, drain and patch Hyper-V hosts, then patch the remaining server fleet.
Test groups. Keep a small, representative test group for each role: a DC, a DNS/DHCP server, a SQL node, an RDS host and a Hyper-V host. Give it 24–72 hours before broad rollout. This month, the zero-day deadline may not leave that much time for RDS and jump hosts, so test those first. Watch for authentication, name-resolution and cluster failover problems. Maintenance windows. Assign every group a window, stagger redundant pairs so that both halves are never down at once, and keep an emergency window ready for zero-days.
Air-gapped and isolated servers
Isolated networks still need this month’s fixes, and copying files across by hand is slow and error-prone. With JetPatch Offline Windows Patching, the JetPatch Manager is the only component that ever reaches Microsoft. Updates are digital-fingerprint verified against Microsoft’s own catalog, and any file that fails verification is quarantined. Isolated servers then patch from a local store without any internet access, and are re-scanned afterwards to confirm the update is installed.
What this means for WSUS
Microsoft has deprecated WSUS. It still ships with Windows Server and still delivers this month’s updates, but it gets no new features, and this month it needs security fixes of its own. JetPatch works with your existing WSUS, including primary and replica servers and bidirectional group sync. When you are ready, you can patch Windows Server from the JetPatch repository instead and retire the WSUS server on your own schedule. See your WSUS options.
How JetPatch helps
JetPatch Windows patch management runs Patch Tuesday from a single console. You can group servers by role, assign maintenance windows and schedules, and validate endpoint readiness before deployment: WUA communication, WSUS connectivity, PowerShell policy, connector health and repository configuration. You can manage exemptions for sensitive hosts and produce compliance reports that show which servers have the October fixes. The same console covers third-party Windows applications, Linux and Unix.
FAQ
How many vulnerabilities did Microsoft fix in October 2026?
Microsoft lists 1,413 CVEs in its October 2026 release notes, up from 999 in September. 76 of the Microsoft-assigned CVEs are rated Critical.
Are any October 2026 vulnerabilities being exploited?
Yes, one. CVE-2026-96951, a Windows Shell security feature bypass, is being exploited. CISA added it to the KEV catalog on October 13 with a remediation deadline of October 16, 2026. CVE-2026-108398 in .NET Framework was publicly disclosed but is not known to be exploited.
Which servers should I patch first?
Start with RDS session hosts, jump servers and admin servers, because of the exploited Windows Shell bug. Then patch DHCP, DNS, RRAS, NPS, IIS and MSMQ servers, then domain controllers in waves, then SQL Server, Exchange and SharePoint, then WSUS servers, Hyper-V hosts and everything else.
Can I still use WSUS for these updates?
Yes. WSUS is deprecated but still delivers updates, and this month it also needs its own security fixes. JetPatch can manage patching through your existing WSUS, or patch from the JetPatch repository when you decide to move off it.
Ready to make next Patch Tuesday routine? Request a JetPatch evaluation and see how your Windows servers, connected or air-gapped, can be patched on schedule.
