Another month of patches equals another new record for Microsoft patches. It’s a good thing I survive Pwn2Own Ireland, because between these and the Adobe patches, there’s much to discuss. I’m also looking at different ways I can represent the bugs at this level of volume, so let me know if you have ideas. (Seriously – I’m out of ideas). If you’d rather watch the full video recap covering the entire release, you can check out the Patch Report webcast on our YouTube channel. It should be posted within a couple of hours after the release.

Adobe Patches for October 2026

For the first part of the October release, Adobe released 11 bulletins addressing 174 unique CVEs in Adobe Dimension, Commerce, Substance 3D Sampler, ColdFusion, Photoshop, FrameMaker, Experience Manager, Substance 3D Stager, Content Credentials SDK, Bridge, and Substance 3D Designer.

Here’s this month’s overview table:

The one I’d treat as most urgent is the patch for ColdFusion despite the Priority 2 rating. In addition to the CVSS 10 bug, the 10 Critical CVEs include unrestricted file upload (CWE-434), code injection (CWE-94), SSRF, and incorrect authorization — a classic pre-auth RCE profile on an internet-facing server product. Impacts run from arbitrary code execution and privilege escalation to arbitrary file read/write. Up next is the bulletin covering Commerce. It may have the smallest count, but it’s a high-value target, and it follows last month’s actively exploited Commerce zero-day (CVE-2026-75650). The Critical bugs include template-engine injection and incorrect authorization, yielding code execution, privilege escalation, and arbitrary file write. Adobe’s table also flags whether authentication is required per CVE, which is useful for triage here. Finally, the other Priority 2 update covers Experience Manager and is the broadest of the three. Beyond the usual XSS volume (stored, reflected, and DOM-based), it includes genuinely serious server-side bugs: OS command injection, SQL injection, XXE, XML injection, and path traversal, leading to code execution, privilege escalation, and security feature bypass. Worth noting the Vulnerability Details table has 34 rows, but CVE-2026-106631 is listed twice, so it’s 33 distinct CVEs.

Aside from the bugs mentioned, all other Adobe patches are Deployment Priority 3. None of the other Adobe bugs receiving patches this month are listed as publicly known or under active attack at the time of release.

Microsoft Patches for October 2026

Before we get into this month’s Microsoft release, let’s talk about what they changed. Microsoft is introducing “risk cohorts”. According to Microsoft, “They are an exploratory way to help customers organize their own analysis. They are not official Microsoft vulnerability categories, do not change Microsoft update guidance, and do not replace the assessment of individual CVEs.” Back in my day, we called these security bulletins. One component could have multiple CVEs in a single bulletin. Microsoft is reintroducing this concept at the group level. I applaud this change as it mirrors my analysis from last month (and this month). Time will tell if enterprises can capitalize on these “cohorts”, but any move made to make the monthly release more manageable is a welcome one. You can read the full details on Microsoft’s site here.

Now on to our regularly scheduled analysis.

Well, it’s a new record release from Microsoft, again. This is also the first four-digit volume we have ever seen and includes six-digit CVEs. As always, counting this load is tricky, but I see 1,415 new CVEs from Microsoft. That puts this month at a greater volume than any previous YEAR from Microsoft. I’m starting to think I don’t like this new normal. As for the products affected by this release, we have Windows and Windows components, Office and Office Components, Developer Tools and .NET, SharePoint, Linux kernel, Skype for Business and Microsoft Lync, SQL Server and Dynamics, Azure and cloud services, and Exchange server.

Still, if there’s solace to be had, it’s in the fact that only one of these bugs is under active attack. If you go back to the “Hot 0-day Summer” of 2023, there were 17 Microsoft 0-days between January and October as opposed to 15 this year during the same period. The total number of Microsoft CVEs in 2023? Just 914. So, AI is certainly helping in bug discovery (and likely in bug patching), but we haven’t seen the same increase in the exploitation of 0-days – yet. As witnessed at the last Pwn2Own, AI-assisted exploitation is most certainly a thing. It just hasn’t hit the mainstream yet, even though other incidents are on the rise.

Hundreds of CVEs in a single release used to be the exception; now it’s the baseline. Is AI to blame? Partly. It’s accelerating bug-hunting on both sides of the fence, so vendors are finding (and fixing) more flaws, and researchers are finding them faster too. But AI isn’t creating these bugs out of thin air. It’s just shortening the time between a vulnerability existing and someone noticing it. What matters is that discovery is scaling faster than exploitation, so teams that triage by sheer CVE count instead of exploitability are burning cycles on the wrong bugs. Patch what’s proven, prioritized, and public, and treat everything else as this month’s new normal.

Two bugs in this release are listed as publicly known: CVE-2026-108398, a .NET Framework security feature bypass that could let an attacker evade Windows Defender Application Control (WDAC) enforcement, and CVE-2026-92707, a denial-of-service bug in MessagePack-CSharp that was released by a third party and is now included in Microsoft’s release. Neither is listed as under active attack. As always, we’ll start with the bug under active attack and move on from there.

-              CVE-2026-96951 - Windows Shell Security Feature Bypass Vulnerability
This is the lone bug listed as under active attack, and it’s certainly a type of bug we’ve seen before. Going back to 2024, attackers have used multiple methods to avoid Mark of the Web (MotW) protections. This time, it’s Shell instead of SmartScreen, but the result is the same. As with any bug under active attack, test and deploy this patch quickly

-              CVE-2026-102866 – Microsoft Office SharePoint Elevation of Privilege Vulnerability
There are lots of SharePoint bugs this month, but this one stands out. It’s the only Critical-rated SharePoint CVE (CVSS 8.1), and the only one an unauthenticated attacker can exploit. It’s an improper cryptographic signature verification bug. An attacker who obtains a valid proof token for a targeted user could modify it, submit it to the server, and authenticate as that user. The only caveat is that the attacker has to obtain that token first, but there are multiple methods this could be achieved.

-              CVE-2026-65674 – Microsoft SQL Server Remote Code Execution Vulnerability
Like SharePoint, there’s lots to choose from in the SQL component. This one is the highest-scoring CVSS at 8.8 and has the best exploitability rating of any SQL Server bug this month. It’s a deserialization of untrusted data. An authenticated attacker connects to an affected SQL Server and sends a specially crafted request to run code on the server. No user interaction is needed. Definitely check this on any SQL Server directly connected to the internet.

-              CVE-2026-70571 - Microsoft Exchange Server Remote Code Execution Vulnerability
Technically speaking, this is a wormable bug in Exchange Server. However, I wouldn’t count on that happening. Microsoft states, “Exploitation requires an attacker to have a deep understanding of the target environment and is not guaranteed to succeed.” While the wording is obtuse, it generally means the likelihood of stars aligning to exploit the Exchange Server through this bug is minuscule. 

Speaking of Wormable…

 I normally call out every bug I think is wormable, but there are just too many this month. Let me sum up. A total of 59 of the October CVEs fit my definition of wormable. Specifically, 57 contain both “An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network” and “No authentication or user interaction is required.” Two more, CVE-2026-70147 and CVE-2026-88178, use variant wording but also require no authentication or user interaction. These bugs are as follows:

•        DHCP Server (6): CVE-2026-96934, 88117, 88119, 88120, 96320, 69830

•        Network Policy Server (4): CVE-2026-100222, 85806, 85371, 85799

•        Windows Error Reporting (4): CVE-2026-83519, 83693, 83748, 97815

•        Remote Desktop Gateway (3): CVE-2026-70187, 100218, 84012

•        Text Shaping (3): CVE-2026-102210, 83770, 97814

•        Two each (14): QUIC (CVE-2026-100219, 105016), Schannel (CVE-2026-105008, 105005), DNS Server (CVE-2026-83869, 70127), Media Foundation (CVE-2026-83517, 85814), Microsoft XML (CVE-2026-83935, 83914), RRAS (CVE-2026-85792, 85809) and PostScript Printer Driver (CVE-2026-70147, 70153)

•        One each (25): Windows Search (CVE-2026-105010), TCP/IP (CVE-2026-69913), IIS (CVE-2026-70024), libarchive (CVE-2026-70062), Rich Text Edit Control (CVE-2026-70096), System Information Console (CVE-2026-70157), .NET (CVE-2026-70197), Active Directory Domain Services (CVE-2026-70229), PowerShell (CVE-2026-83578), CCFFilter Driver (CVE-2026-83780), Shell (CVE-2026-83782), Paint (CVE-2026-83844), Network Load Balancing (CVE-2026-83862), RPC Runtime (CVE-2026-83910), PPP EAP-TLS (CVE-2026-84015), Volume Manager Extension Driver (CVE-2026-85928), Failover Cluster (CVE-2026-88102), Failover Cluster Virtual Driver (CVE-2026-96864), LSASS (CVE-2026-96219), BitLocker (CVE-2026-96909), OLE (CVE-2026-96924), PowerPoint (CVE-2026-88178), Message Queuing (CVE-2026-108460), OpenSSH for Windows (CVE-2026-97816) and Partition Management Driver (CVE-2026-97805)

I may be wrong about some of these – there are a few where the description is somewhat…er…ambiguous, but regardless, this number of wormable bugs in 2026 should cause some level of concern. Not panic. There’s no need for that, but it is disconcerting to see this many juicy targets sitting out there. Please do your best to test and deploy these fixes in a timely manner.

Here’s the full list of CVEs released by Microsoft for October 2026: