> Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities

Microsoft has released its monthly security update for October 2026, which includes 1415 vulnerabilities affecting a range of products, including 85 that Microsoft marked as "critical."Microsoft notes that 1 of the vulnerabilities disclosed this month have been exploited in the wildCVE-2026-96951 is a security feature bypass vulnerability that affects Windows Shell. The shared weakness is Improper Neutralization of Special Elements used in a Command ('Command Injection'). The vulnerability has a CVSS base score of 8.8.Out of 85 "critical" vulnerabilities, 67 are remote code execution (RCE) vulnerabilities.Microsoft considers exploitation of the following vulnerabilities more likely.CVE-2026-70229 is a remote code execution vulnerability that affects Windows Active Directory Domain Services. The shared weakness is Incorrect Authorization. The vulnerability has a CVSS base score of 8.1.CVE-2026-70571 is a remote code execution vulnerability that affects Microsoft Exchange Server. The shared weakness is Stack-based Buffer Overflow. The vulnerability has a CVSS base score of 8.1.Microsoft considers exploitation of the following vulnerabilities less likely.CVE-2026-105733, CVE-2026-102214, and CVE-2026-108399 affect Windows Hyper-V. CVE-2026-105733 has an impact of remote code execution; involves Incorrect Initialization of Resource; has a CVSS base score of 8.8. CVE-2026-102214 has an impact of remote code execution; involves Use After Free; has a CVSS base score of 8.8. CVE-2026-108399 has an impact of elevation of privilege; involves Heap-based Buffer Overflow; has a CVSS base score of 7.2.CVE-2026-100202 is a remote code execution vulnerability that affects Windows Message Queuing Queue Manager. The shared weakness is Use After Free. The vulnerability has a CVSS base score of 9.8.CVE-2026-100209, CVE-2026-100210, CVE-2026-100211, CVE-2026-97739, CVE-2026-97745, CVE-2026-97755, CVE-2026-97759, CVE-2026-97765, CVE-2026-97778, CVE-2026-97741, CVE-2026-97742, CVE-2026-97753, CVE-2026-97756, CVE-2026-97758, CVE-2026-97761, CVE-2026-97767, CVE-2026-97776, and CVE-2026-97780 are remote code execution vulnerabilities that affect Microsoft Office Excel. Each has a CVSS base score of 8.8. CVE-2026-100209, CVE-2026-100211, CVE-2026-97745, and CVE-2026-97759 involve Use After Free. CVE-2026-100210, CVE-2026-97765 , CVE-2026-97756,  CVE-2026-97758, CVE-2026-97776, and CVE-2026-97780 involve Heap-based Buffer Overflow. CVE-2026-97739 involves Heap-based Buffer Overflow and Integer Underflow (Wrap or Wraparound). CVE-2026-97755 involves Out-of-bounds Read. CVE-2026-97778 involves Integer Overflow or Wraparound. CVE-2026-97741 involves Heap-based Buffer Overflow and Off-by-one Error. CVE-2026-97742 involves Stack-based Buffer Overflow. CVE-2026-97753 involves Heap-based Buffer Overflow and Integer Overflow or Wraparound. CVE-2026-97761 involves Stack-based Buffer Overflow. CVE-2026-97767 involves Double Free and NULL Pointer Dereference.CVE-2026-100215 is a remote code execution vulnerability that affects Microsoft Graphics Component. The shared weakness is Heap-based Buffer Overflow. The vulnerability has a CVSS base score of 7.8.CVE-2026-100219 and CVE-2026-105016 are remote code execution vulnerabilities that affect Microsoft QUIC. Each has a CVSS base score of 9.8. CVE-2026-100219 involves Use After Free. CVE-2026-105016 involves Heap-based Buffer Overflow.CVE-2026-100220 is a remote code execution vulnerability that affects Windows Media Video Decoder. The shared weakness is Heap-based Buffer Overflow. The vulnerability has a CVSS base score of 8.8.CVE-2026-102211, CVE-2026-88074, CVE-2026-108130, CVE-2026-108471, and CVE-2026-96914 are elevation of privilege vulnerabilities that affect Windows Virtualization-Based Security (VBS) Enclave. CVE-2026-102211 involves Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') and Use After Free; has a CVSS base score of 7.0. CVE-2026-88074 involves Integer Overflow or Wraparound; has a CVSS base score of 7.8. CVE-2026-108130 involves Heap-based Buffer Overflow; has a CVSS base score of 7.8. CVE-2026-108471 involves Untrusted Pointer Dereference; has a CVSS base score of 8.8. CVE-2026-96914 involves Heap-based Buffer Overflow and Integer Overflow or Wraparound; has a CVSS base score of 8.8.CVE-2026-102225 and CVE-2026-97814 are remote code execution vulnerabilities that affect Windows Text Shaping. CVE-2026-102225 involves Numeric Truncation Error and Out-of-bounds Read; has a CVSS base score of 8.8. CVE-2026-97814 involves Heap-based Buffer Overflow; has a CVSS base score of 9.8.CVE-2026-102855, CVE-2026-102856, and CVE-2026-102857 are remote code execution vulnerabilities that affect Microsoft Office Visio. The shared weakness is Heap-based Buffer Overflow. Each has a CVSS base score of 8.8. CVE-2026-102856 involves Integer Overflow or Wraparound. CVE-2026-102857 involves Off-by-one Error.CVE-2026-102866 is an elevation of privilege vulnerability that affects Microsoft Office SharePoint. The shared weakness is Improper Verification of Cryptographic Signature. The vulnerability has a CVSS base score of 8.1.CVE-2026-62840 is an elevation of privilege vulnerability that affects Linux Kernel. The shared weakness is Time-of-check Time-of-use (TOCTOU) Race Condition. The vulnerability has a CVSS base score of 7.0.CVE-2026-69802 is a remote code execution vulnerability that affects Network Device Enrollment Service (NDES). The shared weakness is Weak Authentication. The vulnerability has a CVSS base score of 8.1.CVE-2026-70147, CVE-2026-70153, and CVE-2026-108467 are remote code execution vulnerabilities that affect Microsoft PostScript Printer Driver. The shared weakness is Heap-based Buffer Overflow. CVE-2026-70147 has a CVSS base score of 9.8. CVE-2026-70153 has a CVSS base score of 9.8. CVE-2026-108467 has a CVSS base score of 8.8.CVE-2026-70187 is a remote code execution vulnerability that affects Windows Remote Desktop Services. The shared weakness is Use After Free. The vulnerability has a CVSS base score of 8.1.CVE-2026-70250 is a remote code execution vulnerability that affects Windows DHCP Client. The shared weakness is Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') and Use After Free. The vulnerability has a CVSS base score of 8.8.CVE-2026-83934 is a remote code execution vulnerability that affects Windows GDI+. The shared weakness is Stack-based Buffer Overflow. The vulnerability has a CVSS base score of 8.8.CVE-2026-88073 is an elevation of privilege vulnerability that affects Windows Graphics Kernel. The shared weakness is Use After Free. The vulnerability has a CVSS base score of 8.8.CVE-2026-88117, CVE-2026-88119, CVE-2026-88120, CVE-2026-88171, and CVE-2026-96934 are remote code execution vulnerabilities that affect Windows DHCP Server. CVE-2026-88117, CVE-2026-88119, and CVE-2026-88120 involve Use After Free; each has a CVSS base score of 8.1. CVE-2026-88171 involves Double Free; has a CVSS base score of 8.1. CVE-2026-96934 involves Use After Free; has a CVSS base score of 9.8.CVE-2026-96222 and CVE-2026-108131 are spoofing vulnerabilities that affect Active Directory Federation Services (AD FS). CVE-2026-96222 involves Improper Certificate Validation; has a CVSS base score of 7.4. CVE-2026-108131 has a CVSS base score of 7.5.CVE-2026-96913 is an elevation of privilege vulnerability that affects Windows Kernel. The shared weakness is Heap-based Buffer Overflow. The vulnerability has a CVSS base score of 8.8.CVE-2026-96952 is a remote code execution vulnerability that affects Microsoft Windows Media Foundation. The shared weakness is Heap-based Buffer Overflow. The vulnerability has a CVSS base score of 8.8.CVE-2026-105718 is a remote code execution vulnerability that affects Microsoft Excel. The shared weakness is Improper Input Validation and Out-of-bounds Read. The vulnerability has a CVSS base score of 8.8.CVE-2026-108400 is a remote code execution vulnerability that affects HEVC Video Extensions. The shared weakness is Integer Overflow or Wraparound. The vulnerability has a CVSS base score of 8.8.CVE-2026-108457 is a remote code execution vulnerability that affects Microsoft Windows PDF. The shared weakness is Out-of-bounds Write. The vulnerability has a CVSS base score of 8.1.CVE-2026-108460 is a remote code execution vulnerability that affects Windows Message Queuing. The shared weakness is Use After Free. The vulnerability has a CVSS base score of 8.1.CVE-2026-70215, CVE-2026-88144, CVE-2026-88178, and CVE-2026-88207 are remote code execution vulnerabilities that affect Microsoft Office PowerPoint. CVE-2026-70215 and CVE-2026-88144 involve Use After Free; has a CVSS base score of 8.8. CVE-2026-88178 involves Use After Free; has a CVSS base score of 9.8. CVE-2026-88207 involves Heap-based Buffer Overflow; has a CVSS base score of 7.5.CVE-2026-70242, CVE-2026-70291, CVE-2026-88156, CVE-2026-97016, and CVE-2026-97749 are remote code execution vulnerabilities that affect Microsoft Office Outlook. Each has a CVSS base score of 9.8. CVE-2026-70242, CVE-2026-70291, and CVE-2026-97016 involve Heap-based Buffer Overflow. CVE-2026-88156 involves Stack-based Buffer Overflow. CVE-2026-97749 involves Double Free.CVE-2026-70269 and CVE-2026-70300 are remote code execution vulnerabilities that affect Microsoft Office Word. CVE-2026-70269 involves Heap-based Buffer Overflow and Integer Overflow or Wraparound; has a CVSS base score of 8.1. CVE-2026-70300 involves Untrusted Pointer Dereference; has a CVSS base score of 9.8.CVE-2026-83917 is an elevation of privilege vulnerability that affects Windows ALPC. The shared weakness is Use After Free. The vulnerability has a CVSS base score of 7.0.CVE-2026-94510 is an elevation of privilege vulnerability that affects Microsoft Bookings. The shared weakness is Authorization Bypass Through User-Controlled Key. The vulnerability has a CVSS base score of 9.9.CVE-2026-96202 and CVE-2026-96943 are remote code execution vulnerabilities that affect Windows Raw Image Extension. The shared weakness is Heap-based Buffer Overflow. Each has a CVSS base score of 8.8. CVE-2026-96943 involves Integer Overflow or Wraparound.CVE-2026-96207 is an elevation of privilege vulnerability that affects Microsoft Partner Center. The shared weakness is Improper Certificate Validation. The vulnerability has a CVSS base score of 10.0.Microsoft considers exploitation of the following vulnerabilities unlikely.CVE-2026-69789 is a remote code execution vulnerability that affects Windows Reliable Multicast Transport Driver (RMCAST). The shared weakness is Heap-based Buffer Overflow. The vulnerability has a CVSS base score of 7.5.CVE-2026-88174 is a remote code execution vulnerability that affects Windows Deployment Services. The shared weakness is Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'). The vulnerability has a CVSS base score of 8.1.CVE-2026-88185 is a remote code execution vulnerability that affects Microsoft Office Word. The shared weakness is Heap-based Buffer Overflow. The vulnerability has a CVSS base score of 8.1.Other critical vulnerabilitiesCVE-2026-69435 is an elevation of privilege vulnerability that affects Azure SRE Agent. The shared weakness is Server-Side Request Forgery (SSRF). The vulnerability has a CVSS base score of 9.6.CVE-2026-77900 is a remote code execution vulnerability that affects Azure App Service. The shared weakness is Missing Authentication for Critical Function. The vulnerability has a CVSS base score of 9.8.CVE-2026-83943 is an information disclosure vulnerability that affects Azure API Center. The vulnerability has a CVSS base score of 8.7.CVE-2026-83947 is a spoofing vulnerability that affects Azure Event Grid. The shared weakness is Missing Authorization. The vulnerability has a CVSS base score of 7.7.CVE-2026-88131 is a remote code execution vulnerability that affects Microsoft Dataverse. The shared weakness is Deserialization of Untrusted Data. The vulnerability has a CVSS base score of 9.8.Talos would also like to highlight the following "important" vulnerabilities as Microsoft has determined that their exploitation is "more likely:"CVE-2026-100214: Microsoft Dynamics 365 Business Central Remote Code Execution VulnerabilityCVE-2026-102217: WebDAV Elevation of Privilege VulnerabilityCVE-2026-69673: Windows Update Elevation of Privilege VulnerabilityCVE-2026-69718: Windows Update Elevation of Privilege VulnerabilityCVE-2026-69733: Windows Update Elevation of Privilege VulnerabilityCVE-2026-69783: Windows Update Elevation of Privilege VulnerabilityCVE-2026-69882: Windows Update Elevation of Privilege VulnerabilityCVE-2026-69923: Windows AI Elevation of Privilege VulnerabilityCVE-2026-69926: Desktop Window Manager Elevation of Privilege VulnerabilityCVE-2026-70054: Windows NetBIOS Elevation of Privilege VulnerabilityCVE-2026-70060: Windows Win32k Elevation of Privilege VulnerabilityCVE-2026-70076: Windows Win32k Elevation of Privilege VulnerabilityCVE-2026-70104: Windows Win32k Elevation of Privilege VulnerabilityCVE-2026-70108: Windows Win32k Elevation of Privilege VulnerabilityCVE-2026-70117: Windows Win32k Elevation of Privilege VulnerabilityCVE-2026-70132: Windows Portable Device File System Driver Elevation of Privilege VulnerabilityCVE-2026-70144: Windows Win32k Elevation of Privilege VulnerabilityCVE-2026-70156: Microsoft Windows Search Component Elevation of Privilege VulnerabilityCVE-2026-70218: Windows StateRepository API Elevation of Privilege VulnerabilityCVE-2026-70223: Windows Console Driver Elevation of Privilege VulnerabilityCVE-2026-70233: Windows Common Log File System Driver Elevation of Privilege VulnerabilityCVE-2026-70236: Windows Win32k Elevation of Privilege VulnerabilityCVE-2026-70237: Windows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityCVE-2026-70241: Windows Kerberos Elevation of Privilege VulnerabilityCVE-2026-70245: Windows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityCVE-2026-70249: Windows Win32k Elevation of Privilege VulnerabilityCVE-2026-70253: Windows Win32k Elevation of Privilege VulnerabilityCVE-2026-70255: Desktop Window Manager Elevation of Privilege VulnerabilityCVE-2026-70271: Windows Win32k Elevation of Privilege VulnerabilityCVE-2026-70273: Windows Win32k Elevation of Privilege VulnerabilityCVE-2026-70286: Windows Graphics Component Elevation of Privilege VulnerabilityCVE-2026-70303: Windows Kernel Elevation of Privilege VulnerabilityCVE-2026-72955: Windows Application Compatibility Cache Elevation of Privilege VulnerabilityCVE-2026-81971: Windows NTFS Elevation of Privilege VulnerabilityCVE-2026-83505: Windows Setup Files Cleanup Elevation of Privilege VulnerabilityCVE-2026-83509: Windows Setup Files Cleanup Elevation of Privilege VulnerabilityCVE-2026-83510: Windows Setup Files Cleanup Elevation of Privilege VulnerabilityCVE-2026-83580: Windows Client-Side Caching (CSC) Service Elevation of Privilege VulnerabilityCVE-2026-83669: Windows Error Reporting Elevation of Privilege VulnerabilityCVE-2026-83699: Windows Client-Side Caching (CSC) Service Elevation of Privilege VulnerabilityCVE-2026-83704: Microsoft Windows Search Component Elevation of Privilege VulnerabilityCVE-2026-83717: Windows Installer Elevation of Privilege VulnerabilityCVE-2026-83724: Windows Management Instrumentation Elevation of Privilege VulnerabilityCVE-2026-83732: Win32k Elevation of Privilege VulnerabilityCVE-2026-83735: Windows Kernel Elevation of Privilege VulnerabilityCVE-2026-83738: Windows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityCVE-2026-83750: Windows Error Reporting Elevation of Privilege VulnerabilityCVE-2026-83761: Windows Win32 Kernel Subsystem Elevation of Privilege VulnerabilityCVE-2026-83763: Windows Input System Elevation of Privilege VulnerabilityCVE-2026-83768: Windows Kernel Elevation of Privilege VulnerabilityCVE-2026-83769: Microsoft OpenSSH for Windows Elevation of Privilege VulnerabilityCVE-2026-83793: Windows Update Orchestrator Service Elevation of Privilege VulnerabilityCVE-2026-83830: Windows COM+ Event System Service Elevation of Privilege VulnerabilityCVE-2026-83834: Windows Kernel-Mode Drivers Elevation of Privilege VulnerabilityCVE-2026-83840: Windows Error Reporting Elevation of Privilege VulnerabilityCVE-2026-83842: Windows TCP/IP Elevation of Privilege VulnerabilityCVE-2026-83848: Windows COM+ Event System Service Elevation of Privilege VulnerabilityCVE-2026-83867: Windows Push Notifications Elevation of Privilege VulnerabilityCVE-2026-83886: Windows Update Orchestrator Service Elevation of Privilege VulnerabilityCVE-2026-83896: Windows Direct Composition Elevation of Privilege VulnerabilityCVE-2026-83899: Windows Installer Elevation of Privilege VulnerabilityCVE-2026-83902: Windows Direct Composition Elevation of Privilege VulnerabilityCVE-2026-83921: Windows Search Service Elevation of Privilege VulnerabilityCVE-2026-84014: Windows Device Association Service Elevation of Privilege VulnerabilityCVE-2026-85355: Windows Common Log File System Driver Elevation of Privilege VulnerabilityCVE-2026-85791: Windows Encrypting File System (EFS) Elevation of Privilege VulnerabilityCVE-2026-85802: Windows Win32 Kernel Subsystem Elevation of Privilege VulnerabilityCVE-2026-85804: Windows Win32 Kernel Subsystem Elevation of Privilege VulnerabilityCVE-2026-85832: Windows Background Intelligent Transfer Service (BITS) Elevation of Privilege VulnerabilityCVE-2026-85843: Windows Background Intelligent Transfer Service (BITS) Elevation of Privilege VulnerabilityCVE-2026-85848: Windows Background Intelligent Transfer Service (BITS) Elevation of Privilege VulnerabilityCVE-2026-85849: Windows AppX Deployment Service Elevation of Privilege VulnerabilityCVE-2026-85850: Windows Kernel Elevation of Privilege VulnerabilityCVE-2026-85855: Windows DWM Core Library Elevation of Privilege VulnerabilityCVE-2026-85870: Windows Common Log File System Driver Elevation of Privilege VulnerabilityCVE-2026-85901: Windows Graphics Component Elevation of Privilege VulnerabilityCVE-2026-85908: Windows Graphics Component Elevation of Privilege VulnerabilityCVE-2026-85941: Windows Installer Elevation of Privilege VulnerabilityCVE-2026-85945: Windows Kernel Elevation of Privilege VulnerabilityCVE-2026-88118: Windows Background Intelligent Transfer Service (BITS) Elevation of Privilege VulnerabilityCVE-2026-88133: Windows Portable Device Enumerator Service Elevation of Privilege VulnerabilityCVE-2026-88147: Windows Secure Socket Tunneling Protocol (SSTP) Elevation of Privilege VulnerabilityCVE-2026-88152: Windows Background Intelligent Transfer Service (BITS) Elevation of Privilege VulnerabilityCVE-2026-88159: Windows Background Intelligent Transfer Service (BITS) Remote Code Execution VulnerabilityCVE-2026-88191: Microsoft Windows Search Component Elevation of Privilege VulnerabilityCVE-2026-96858: Windows Security Account Manager Tampering VulnerabilityCVE-2026-96911: Microsoft Windows Search Component Elevation of Privilege VulnerabilityCVE-2026-96929: Windows Kernel Elevation of Privilege VulnerabilityCVE-2026-96940: Microsoft Exchange Server Elevation of Privilege VulnerabilityCVE-2026-69452: Windows Enterprise App Management Elevation of Privilege VulnerabilityCVE-2026-69880: Desktop Window Manager Elevation of Privilege VulnerabilityCVE-2026-69918: Windows Core Messaging Elevation of Privilege VulnerabilityCVE-2026-70103: Windows Error Reporting Elevation of Privilege VulnerabilityCVE-2026-70106: Windows Kernel Elevation of Privilege VulnerabilityCVE-2026-70151: Windows Direct Composition Elevation of Privilege VulnerabilityCVE-2026-70176: Windows Win32k Elevation of Privilege VulnerabilityCVE-2026-70279: Microsoft Exchange Server Spoofing VulnerabilityCVE-2026-83785: Windows COM+ Event System Service Elevation of Privilege VulnerabilityCVE-2026-83927: Windows Registry Elevation of Privilege VulnerabilityCVE-2026-85884: Windows Health and Optimized Experiences Service Elevation of Privilege VulnerabilityCVE-2026-85902: Windows Direct Composition Elevation of Privilege VulnerabilityCVE-2026-85906: Windows Direct Composition Elevation of Privilege VulnerabilityCVE-2026-88093: Desktop Window Manager Elevation of Privilege VulnerabilityCVE-2026-96939: Servicing Stack Updates Elevation of Privilege VulnerabilityCVE-2026-97798: Windows Error Reporting Service Elevation of Privilege VulnerabilityCVE-2026-97799: Windows Audio Service Elevation of Privilege VulnerabilityCVE-2026-97800: Windows Mobile Broadband Elevation of Privilege VulnerabilityA complete list of all the other vulnerabilities Microsoft disclosed this month is available on its update page.In response to these vulnerability disclosures, Talos is releasing a new Snort ruleset that detects attempts to exploit some of them. Please note that additional rules may be released at a future date, and current rules are subject to change pending additional information. Cisco Secure Firewall customers should use the latest update to their ruleset by updating their SRU. Open-source Snort Subscriber Ruleset customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.Snort 2 rule coverage: 1:67210 - 1:67273, 1:67276 - 1:67279, 1:67282 - 1:67311, 1:67313 - 1:67316, 1:67319 - 1:67322Snort 3 rule coverage: 1:301663 - 1:301694, 1:301696, 1:301702 - 1:301703, 1:301705 - 1:301706, 1:301709, 1:301711, 1:301717 - 1:301718