Microsoft's 13 October 2026 Patch Tuesday updates fixed roughly 1,400 flaws. An exploited Windows Shell zero-day, 9.8-rated RCEs in DHCP/MSMQ/QUIC, Outlook preview-pane flaws and a final Exchange update, summarized with an SMB action plan.
Microsoft's October 2026 Patch Tuesday updates were released on 13 October 2026. For small and mid-sized businesses (SMBs), the headlines are: an actively exploited Windows Shell zero-day, 9.8-rated remote code execution flaws on servers, critical Outlook flaws triggered through the preview pane, and one final update for Exchange.
The numbers: roughly 1,400, depending on the source
Sources do not fully agree on this month's total, because counting methods differ. BleepingComputer counts 1,411 flaws released on 13 October itself (excluding 348 flaws fixed earlier in the month), SecurityWeek counts 1,413, and SecPod 1,407 CVEs. "Roughly 1,400" is therefore more accurate than a single precise figure. Microsoft fixed 3 zero-days this month: one exploited, two publicly disclosed.
Three zero-days
| CVE | Product | CVSS | Status |
|---|---|---|---|
| CVE-2026-96951 | Windows Shell | 8.8 | Actively exploited, in CISA KEV |
| CVE-2026-108398 | .NET Framework | 8.8 | Publicly disclosed, not exploited |
| CVE-2026-92707 | MessagePack-CSharp (.NET) | 5.3 | Publicly disclosed, not exploited |
CVE-2026-96951 (Windows Shell, 8.8): A command injection flaw that lets an attacker evade Mark of the Web (MOTW) defenses. Microsoft marks exploitation as detected; CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on 13 October. A user must open a crafted file. Microsoft published no workaround; the October cumulative update is the fix.
CVE-2026-108398 (.NET Framework, 8.8): Lets an authenticated attacker bypass Windows Defender Application Control (WDAC) restrictions and run code inside a protected process. Publicly disclosed, not reported exploited.
CVE-2026-92707 (MessagePack-CSharp, 5.3): A network denial-of-service flaw. Publicly disclosed, not reported exploited. Mostly relevant to applications using .NET/SignalR.
Server highlights
| CVE | Product | CVSS | Note |
|---|---|---|---|
| CVE-2026-96934 | Windows DHCP Server | 9.8 | Unauthenticated network RCE |
| CVE-2026-100202 | Windows Message Queuing (MSMQ) | 9.8 | Unauthenticated network RCE |
| CVE-2026-100219 / CVE-2026-105016 | Microsoft QUIC | 9.8 | Unauthenticated network RCE |
| CVE-2026-70229 | Active Directory Domain Services | 8.1 | Microsoft: exploitation more likely |
| CVE-2026-70187 | Windows Remote Desktop Services | 8.1 | Prioritize internet-facing RD Gateway |
| CVE-2026-70571 | Exchange Server | 8.1 (Critical) | Covered in our separate advisory |
| CVE-2026-102866 | SharePoint Server | 8.1 (Critical) | KB5002927 for SE |
Priority: servers running DHCP or MSMQ, domain controllers, and internet-facing Remote Desktop Gateway servers. The QUIC flaws matter for services that use QUIC.
Outlook and Exchange
Two critical Outlook RCEs (9.8): CVE-2026-70291 and CVE-2026-88156. Microsoft states the Preview/Reading Pane is an attack vector for both: merely viewing a crafted email in the Reading Pane can trigger the flaw, without opening the message or clicking anything. Roll out the Outlook update as quickly as client updates allow.
Exchange CVE-2026-70571 (8.1, Critical): See our separate security advisory for details. In short: KB5128895 for Exchange SE, KB5128896 for 2019 CU15; the 2016/2019 updates are offered only to Period 2 ESU-enrolled organizations, and this is the last security update for 2016/2019.
Windows Server update numbers (13 October 2026)
| Version | Update |
|---|---|
| Windows Server 2025 | KB5126646 |
| Windows Server 2022 | KB5126655 |
| Windows Server 2019 | KB5126651 |
| Windows Server 2016 | KB5126868 |
One more note: Extended Security Updates (ESU) for Windows Server 2012/R2 ended on 13 October 2026. According to Microsoft's lifecycle pages, no further security updates will be released for 2012/R2 after this date. If you still run 2012/R2, this month's updates do not reach you; a move to a supported version can no longer wait.
Action plan for SMBs
- Install the cumulative updates: Servers first (especially DHCP, MSMQ, domain controllers, RD Gateway, Exchange, SharePoint), then all clients. Make sure restarts complete; a pending update provides no protection.
- Update Outlook at the same pace: Because of the preview-pane flaws, do not leave clients until after the servers.
- Check Exchange: Confirm KB5128896/KB5128897/KB5128898 on ESU-enrolled 2016/2019 and KB5128895 on SE. Without ESU, the Exchange upgrade/migration decision must be made this month.
- List unsupported systems: Server 2012/R2 (ESU ended) and end-of-support Exchange 2016/2019. "Patch later" is no longer an option for these; isolate them and set a firm migration date.
- Verify the result: Check WSUS/Intune reports for failed updates and devices still pending restart.
How can Doğa Network help?
Our team can help with the planned, controlled rollout of the October updates across your servers and clients, Exchange SE upgrades or Microsoft 365 migrations, migration plans and licensing calculations for unsupported systems such as Server 2012/R2 and Exchange 2016/2019. Reach us at +90 850 888 3642 or hi@doga.network.
Sources
- MSRC – Security Update Guide, October 2026
- MSRC – CVE-2026-96951 (Windows Shell)
- CISA – KEV catalog addition, 13 October 2026
- MSRC – CVE-2026-70571 (Exchange Server)
- Microsoft Support – SharePoint Server SE, 13 October 2026 (KB5002927)
- Microsoft Support – Windows Server 2025 (KB5126646), Server 2022 (KB5126655), Server 2019 (KB5126651), Server 2016 (KB5126868)
- Secondary sources for the total count: BleepingComputer (1,411), SecurityWeek (1,413)
More articles
October 2026 Windows Server updates can break Exchange: symptoms and fix
After installing the October 2026 Windows Server updates, on-premises Exchange servers may show OWA errors, growing mail queues and DAG problems. Microsoft has confirmed the issue and published a workaround that does not require removing the update. Here are the symptoms, the affected updates and a step-by-step fix.
Read more →
Last month for Exchange 2016/2019: ESU program ends with October 2026
Exchange Server 2016 and 2019 reached end of support on 14 October 2025. The paid Extended Security Update (ESU) program now closes at the end of October 2026, and Microsoft has said there will be no further extension. For servers on ESU, this is the last month of updates. Here is what changes, the risks and your options.
Read more →
13 October 2026: Last patch for Windows Server 2012/R2, Windows 10 ESU year one ends
Patch Tuesday on 13 October 2026 will be the last Extended Security Updates (ESU) release for Windows Server 2012 and 2012 R2. On the same day, year one of the commercial ESU programme for Windows 10 ends, and Windows Server 2022 moves from mainstream to extended support. Here are the dates, the costs and an action plan for SMBs.
Read more →