Microsoft’s October 2026 Patch Tuesday is the year’s largest release, with 1,408 CVEs requiring customer action, 72 of them rated critical. September, the previous high, carried 963. One CVE is already exploited: CVE-2026-96951, a Windows Shell flaw that bypasses Mark of the Web. Two were publicly disclosed before release, in the .NET Framework and the MessagePack-CSharp library. Separately, on 25 September Microsoft reported attacks against CVE-2026-65660, a SharePoint Server flaw fixed in August. Readiness recommends a Patch Now scheduling for Windows, Office, Exchange and the developer tooling, and a standard release schedule for SQL Server. The Readiness team has published an infographic summarising deployment risk by product family.

Known issues

On 14 October, Microsoft added a known issue to this month’s Windows 11 updates, KB5127648 for versions 24H2, 25H2 and 26H2, and KB5127646 for 26H1. Non-admin users might be unable to open Remote Desktop connections to devices that have Administrator protection enabled, with error 0xC000000D. The issue started with September’s non-security preview update. The Windows 11 security baselines enable Administrator protection by default, so test remote access to managed hosts before broad deployment. Microsoft’s mitigation is to turn off Administrator protection temporarily through your policy management tool, and a fix will follow in a future update.

Two issues remain open:

• Some USB Audio Class 1.0 devices might fail to start or produce no sound. The 14 September out-of-band update resolved part of this, and for the remaining symptoms Microsoft directs IT administrators to Microsoft Support for Business.
• Windows Server Update Services still does not display synchronisation error details on Server 2025 and Server 2022. Microsoft removed the function to address CVE-2025-59287 and offers no workaround.

And three are now closed:

• The incorrect “Microsoft Defender Antivirus is turned off” notifications, still open when we published in September, were fixed by Defender Antivirus update 4.18.26080.4, released on 17 September.
• On Windows 11, the October update fixes Explorer failing to start after sign-in on multi-user systems such as Azure Virtual Desktop with FSLogix, which left users at a black screen.
• On Windows 10, Windows 11 23H2 and Server 2016 and 2019, it fixes File History failing to back up or restore and showing a false “Reconnect your drive” message.

Major revisions and mitigations

Between the September and October releases, from 9 September to 12 October, Microsoft’s Security Update Guide notifications covered 111 entries for Microsoft’s own products, not counting Chromium republications for Edge. Of those 111, 90 are true revisions rather than new entries. September’s window had one.

• On 17 September, 84 of September’s CVEs gained Office for Mac updates. Each revision note tells customers running affected Mac software to “install the update for their product to be protected”.
• On 16 September, Microsoft corrected the scoring of three critical SQL Server remote code execution flaws from September, CVE-2026-67378, CVE-2026-67631 and CVE-2026-67643. The scores now record that “an attacker does not require any privileges”. Microsoft calls this an informational change.
• On 25 September, Microsoft revised CVE-2026-65660, a SharePoint Server remote code execution flaw fixed in August, to state that it “had reliable evidence of observed attacks against exploitation of this vulnerability”. CISA added it to its list of known exploited vulnerabilities the same day. The Security Update Guide still shows “Exploited: No” for this CVE, so a report filtered on that flag will miss it. If any SharePoint server lacks the August update, install it now.
• Of the 21 new entries, 18 are critical cloud-side flaws in Azure, Microsoft 365 Copilot, Dataverse and Fabric, all marked “Customer action required: No”. Two are Edge flaws, and one is CVE-2026-96940 in Exchange Server, published on 2 October and covered below.

Microsoft has published no mitigations and no workarounds in the October release.

Windows lifecycle and enforcement updates

These support milestones passed with this release on 13 October, as scheduled:

• Office 2021 retail and Office LTSC 2021, including Skype for Business LTSC 2021, reached the end of support.
• Windows 10 Enterprise 2016 LTSB and Windows 10 IoT Enterprise LTSB 2016 reached the end of extended support.
• Extended Security Updates for Windows Server 2012 and 2012 R2 ended. Year three was the last, so the October update is the final one for both.
• Windows 11 Home and Pro version 24H2 reached the end of updates.
• Windows Server 2022 moved to extended support, which runs to 14 October 2031.

The next milestones fall on 10 November 2026, the date of November’s Patch Tuesday. .NET 8 and .NET 9 reach the end of support, as do PowerShell 7.4 and 7.5. Windows 11 Enterprise and Education 23H2, and IoT Enterprise 23H2, reach the end of updates, and Microsoft says November’s update “will be the last update available for these editions”.

Microsoft also starts or tightens several enforcement changes with this release:

• Windows 11 24H2, 25H2 and 26H2, and Windows Server 2025, now restrict NTLMv1-derived credentials for single sign-on by default. Where Credential Guard is off, Microsoft warns this “might affect Wi-Fi, Ethernet and VPN connections that use MS-CHAPv2-based authentication” (KB5066470).
• AD FS Distributed Key Manager container permissions move into enforcement mode. Supported servers remediate automatically, but Server 2012 and 2012 R2 need manual remediation (KB5121391).
• ReFS volumes on removable media enter an audit phase, and blocking is enabled by default from the January 2027 update (KB5130741).
• The Windows Production PCA 2011 Secure Boot certificate, used to sign the Windows boot loader, expires on 19 October. Devices without its replacement, Windows UEFI CA 2023, keep starting and updating normally, but they stop receiving new early-boot protections (KB5062710).

Microsoft’s test guidance for this release runs to 496 Windows entries, 41 of them flagged as high risk, against 466 and 55 in September. Printing, scanning and font rendering account for 31 of the 41. The Readiness team recommends these testing priorities:

• Printing. Print documents with mixed fonts from 32-bit and 64-bit applications to physical and virtual printers. Add network printers by discovery and by IP address, and print through a shared print server, a USB printer and a PostScript driver.
• Downloaded files. The exploited Shell flaw bypasses Mark of the Web, so open files and shortcuts downloaded from the internet and confirm the SmartScreen and security warnings still appear.
• Remote access. Test Remote Desktop with a non-admin account against hosts that have Administrator protection enabled, and test Wi-Fi and VPN connections that use MS-CHAPv2.
• Application installs. Install, repair and uninstall a representative set of MSI packages, including packages with script custom actions. Windows Installer takes 38 fixes this month.
• Network servers. Run DNS servers (52 fixes) and DHCP servers (18) under load, and confirm leases, zone transfers and conditional forwarders behave as before.

Each month, we break down the update cycle into product families, as defined by Microsoft, with the following groupings.

Browsers

For the third month in a row, Microsoft’s Patch Tuesday release lists no browser CVEs. Edge security fixes arrived between releases instead. Between 9 September and 12 October, Microsoft published 414 CVEs for Microsoft Edge in the Security Update Guide: 409 republished from Chromium and five specific to Edge. None carries an exploited flag, and no Edge release in that period reported an exploit in the wild.

Microsoft Windows

Windows takes 1,122 CVEs this month, 42 of them critical. Elevation of privilege accounts for 617 entries, information disclosure for 200 and remote code execution for 179. Of the 42 critical entries, 31 are remote code execution, nine are elevation of privilege and two are spoofing.

• The exploited flaw is CVE-2026-96951, a Windows Shell security feature bypass that evades Mark of the Web defences. An attacker must convince a user to open a crafted file or follow a link. CISA added it to its list of known exploited vulnerabilities on 13 October, with a remediation date of 16 October.
• DHCP takes 18 fixes, six of them critical remote code execution: five in DHCP Server and one in the DHCP client. DNS Server takes 52, 10 of them remote code execution, though none is critical. Critical remote code execution also affects Hyper-V, Message Queuing, Microsoft QUIC, the Remote Desktop Gateway, Windows Deployment Services, Active Directory Domain Services, NDES and the multicast transport driver.
• In file and image handling, the Raw Image Extension has three critical fixes, one of them a CVE assigned by Cisco Talos, and the PostScript printer driver takes three more. Text shaping takes two, and Media Foundation, the codecs library, the video decoder, GDI+, the graphics component and the Windows PDF component take one each.
• The virtualisation-based security enclave takes eight fixes, five of them critical elevation of privilege.
• The most-patched areas are DNS Server at 52, Win32k at 48, the Windows Kernel at 46 and Windows Installer at 38.

Add this Windows update to your Patch Now schedule. Every client needs the fix for the exploited Shell flaw, and DHCP servers and Hyper-V hosts need the critical server-side fixes.

Microsoft Office

Microsoft released 180 Office CVEs this month, 26 of them critical, and remote code execution accounts for 107.

• Client updates on Windows are Click-to-Run only, for Microsoft 365 Apps, Office LTSC 2021 and Office LTSC 2024. Office for Mac updates ship in the same release this month, rather than nine days later as they did in September. Excel takes 69 fixes, 11 of them critical. Word takes 22, Access 13, Outlook 10 with five critical, PowerPoint nine with four critical, and Visio three, all critical.
• SharePoint Server Subscription Edition takes 34 CVEs in KB5002927, two of them critical. SharePoint Server 2016 and 2019 left extended support on 14 July 2026, and two of this month’s flaws list them as affected with no update: CVE-2026-69943 for both versions and CVE-2026-97783 for 2019.
• Office Online Server takes 43 CVEs in KB5002928. Skype for Business Server takes three, in KB5132779 for 2015 CU13, KB5131693 for 2019 CU8 and KB5131692 for Subscription Edition CU1.

Add these updates to your Patch Now schedule, because 25 of the 26 critical entries affect Excel, Outlook, PowerPoint, Visio and Word.

Microsoft Exchange and SQL Server

Exchange has one critical entry this month and SQL Server has none.

• Exchange Server has seven CVEs across 2016 CU23, 2019 CU14 and CU15, and Subscription Edition: one critical remote code execution, CVE-2026-70571, five elevations of privilege and one spoofing flaw. Six are fixed by the 13 October updates: KB5128895 for Subscription Edition, KB5128896 for 2019 CU15, KB5128897 for 2019 CU14 and KB5128898 for 2016 CU23.
• The seventh, CVE-2026-96940, was published on 2 October. Microsoft lists it against a separate set of updates released that day, KB5129955 to KB5129958, not against the 13 October updates, so confirm both sets are installed. Microsoft rates both CVE-2026-96940 and the critical entry as “Exploitation More Likely”..
• SQL Server has 22 CVEs, none of them critical: eight remote code execution, seven elevation of privilege, four information disclosure and three denials of service. Each supported branch gets a cumulative update and a GDR: 2025 (KB5126967, KB5128492), 2022 (KB5126934, KB5128493), 2019 (KB5128494, KB5128495) and 2017 (KB5128496, KB5128497).

Exchange goes on the Patch Now list. SQL Server goes on the Schedule list because none of its 22 entries is critical. If September’s SQL Server update is still outstanding, install it first.

Microsoft Developer Tools

Microsoft released 66 CVEs across its developer tooling this month: two critical, 63 important and one moderate. Remote code execution accounts for 18 entries and elevation of privilege for 13.

• Both critical entries also affect Windows. CVE-2026-105016 is a remote code execution flaw in Microsoft QUIC that needs no authentication or user interaction, and it affects .NET 8, 9, 10 and 11 on Windows and Visual Studio 2022 and 2026. CVE-2026-96222 is an AD FS certificate validation flaw that Microsoft lists against both the .NET Framework and Windows Server.
• Two entries were publicly disclosed before release. CVE-2026-108398 in the .NET Framework lets an authenticated attacker bypass Windows Defender Application Control. CVE-2026-92707, a denial-of-service vulnerability in the MessagePack-CSharp library assigned by GitHub, affects Visual Studio and the ASP.NET Core SignalR MessagePack protocol.
• Visual Studio Code has 10 fixes, five of them security feature bypasses, and PowerShell 7.4, 7.5 and 7.6 take two.

Add these updates to your Patch Now schedule, starting with the .NET updates that carry the QUIC fix.

Adobe (and third-party updates)

Adobe published 11 security bulletins on 13 October, covering 175 CVEs across ColdFusion, Experience Manager, Commerce, Photoshop, Bridge, FrameMaker, Dimension, the Substance 3D tools and the Content Credentials SDK. None is rated priority 1, and Adobe is not aware of exploits for any of them. No Acrobat or Reader security update for this month. I mentioned last month that we are in for a few months of extraordinary patch releases. Harking back to 2003 (when I started work on the nascent field of Microsoft patch management), with Microsoft releasing just  51 updates, anything over a 1000, much less 1400 CVE entries would have been unimaginable. I don’t think that we are at a “patch maximum” yet — but I hope that things calm down soon.

Microsoft is changing the destination address of two of its most popular services: starting this month, it will redirect M365 and Teams web users to copilot.cloud.microsoft and teams.cloud.microsoft, respectively.

The Teams move is already under way, and Microsoft has now added M365 to the mix. The company announced the changes in two MessageCenter posts: MC1465764 (mirror) and MC1462915 (mirror).

Organizations using these products are advised to update their systems and documentation to ensure continued access. Microsoft has told customers to review configurations on client devices, proxies, firewalls, secure web gateways, or other enterprise network controls to confirm that users can connect to the new addresses. Companies having trouble connecting should ensure that their environment aligns with the recommended network requirements for Microsoft 365 Copilot. 

Enterprises that had been blocking the new Copilot address to prevent employees accessing their personal Microsoft accounts can use Microsoft’s TenantRestrictions control to achieve their goals instead, it said.

All redirects should be completed by early October, Microsoft said, advising companies that can’t meet the deadline to contact their account representative for help. Limited exceptions to the Teams redirect are possible until Dec. 31, 2026, but after that no further delays will be possible, it said.

Zoom has identified, and patched, a critical security hole that “may allow an unauthenticated user to conduct an account takeover via network access.”

The issue is especially significant given Zoom’s extensive reach; it reportedly has more than 300 million daily active users, including 470,000 paying business customers. Given that reach, Zoom has been impacted by many other security incidents and France recently tried banning its use by French government users. 

 Zoom security bulletins released Tuesday revealed the bug, and three other security issues, which Zoom patched on Wednesday. 

The company originally said that the takeover issue impacted Zoom Desktop Client for Windows before version 7.0.0, Zoom VDI Client for Windows before version 7.0.10 and 6.6.15 and 6.5.18 in their respective branches, and Zoom Meeting SDK for Windows, but on Wednesday, without explanation, it removed Meeting SDK for Windows as an affected product.

The other three holes were less severe, but still significant, and they all involved privilege escalation. They impacted Zoom Workplace for Windows before version 7.0.5, Zoom Workplace VDI Client for Windows before 6.5.17 and 6.6.14 in their respective branches, Zoom Workplace VDI plugin for Windows before 6.5.17 and 6.6.14 in their respective branches, Zoom Rooms for Windows before 7.0.5 and Remote Control for Zoom Contact Center for Windows before version 7.0.0.

A second privilege escalation issue impacted Zoom Rooms for Windows before version 7.1.0, and another impacted Zoom Workplace VDI Plugin for Windows before version 6.6.14.

Zoom did not immediately reply to a request for comment.

‘As bad as it gets’

Frank Dickson, group VP for security at IDC, said the nature of the reported hole is alarming.

This bug “is about as bad as it gets, short of a worm. It is exploitable over the network, low complexity, zero privileges required, no user interaction needed,” he said, pointing out that exploitation is easy once technical details leak or someone reverse-engineers the patch, which is not as challenging as it once was, thanks to AI. “Yesterday’s script kiddies have been empowered,” he said.

Dickson said the only good news is that Zoom discovered the hole itself, and that “no in-the-wild exploitation has been reported by any outlet as of Thursday.”

Consultant Brian Levine, executive director of FormerGov, agreed with Dickson’s characterization of the hole, but said a potentially bigger issue is the high level of sensitive data that Zoom accesses. 

“An attacker with unfettered access to a Zoom account may be able to listen to recordings of sensitive meetings, to eavesdrop on future meetings, and to impersonate the organization in an effort to social engineer its clients and partners. Thus, given that ubiquity of Zoom in large enterprises, this vulnerability is pretty concerning,” Levine said.

He’s encouraged, however, that Zoom found the flaw itself, which indicates its security team is “actually doing the hard, unglamorous work of auditing its code.”

Giuseppe Trotta, principal security researcher at Malwarebytes, has a theory about what was behind the Zoom disclosure. 

“Because the vulnerability requires zero privileges and absolutely no user interaction, the remote network attack vector is highly suspected to involve the mishandling of deep links, such as custom URL schemes like zoommtg:// or zoomworkplace://,” he said. This led him to think that if the Zoom Workplace client for Windows fails to properly sanitize and validate incoming arguments passed via these special browser-to-desktop links, an unauthenticated attacker could craft a malicious string that could trick the desktop application into exposing or redirecting the user’s active session tokens directly to an attacker-controlled server, achieving a seamless and completely silent account takeover.

“Watch out for Zoom links and invites if you are on Windows or VDI and haven’t updated yet,” he advised.

Mike Wilkes, enterprise CISO at Aikido Security, offered kudos to Zoom for discovering the critical flaw, but he wanted to know how such a severe bug got into its software initially.

“This vulnerability raises questions about why the defect was not caught by design review, fuzzing, or pre-release abuse-case testing,” Wilkes said. “A historical defect in Zoom’s product/security relationship has been prioritizing ease of use over security risk.”

All four bugs important

Justin Greis, CEO of consulting firm Acceligence, said that the two types of holes reported by Zoom, account takeover and escalation, are both important, but for different reasons. 

“The critical vulnerability is significant because it has the characteristics security teams worry about most,” Greis said, but the privilege escalation holes “are certainly important to patch as they primarily increase the impact of an attack that has already begun. The critical vulnerability has the potential to be an initial entry point, which is why it deserves the most attention.”

Greis also applauded Zoom’s response, saying that it “reflects a reasonably mature security program.”

He pointed out that no complex software platform will eliminate vulnerabilities entirely. “The differentiator is whether vendors are continuously investing in offensive testing, finding weaknesses before attackers do, and moving quickly to develop and distribute fixes,” he said.

The US Cybersecurity and Infrastructure Security Agency (CISA) has urged organizations to immediately secure Microsoft SharePoint deployments after warning that three vulnerabilities affecting the on-premises collaboration platform are being actively exploited.

A recent advisory from the federal cybersecurity watchdog asked administrators to patch vulnerable servers, review Microsoft’s mitigation guidance, and assume that internet-facing SharePoint instances remain attractive targets for attackers seeking an initial foothold into enterprise environments.

While applying patches remains the immediate priority, security experts caution that organizations should view the advisory as more than another Patch Tuesday exercise.

“This is what separates an IT incident from a business crisis,” said Chris Boehm, field CTO at Zero Networks. “One compromised SharePoint box is a ticket. That same box, with a clear path to your domain controllers, backups, and file shares, is how you end up with an encrypted infrastructure and a disclosure event. Segmentation stops the first from becoming the second.”

CISA’s advisory highlights CVE-2026-332201, CVE-2026-45659, and the newly added CVE-2026-56164, all of which have now been confirmed as exploited in the wild and added to the agency’s Known Exploited Vulnerabilities (KEV) catalog.

Exploitation tells a different severity story

The latest addition to CISA’s KEV catalog is CVE-2026-56164, an elevation-of-privilege vulnerability affecting Microsoft SharePoint Server. Although assigned a CVSS score of 5.3, the flaw can be exploited remotely without authentication, making it significantly more dangerous in practice than its severity rating alone suggests.

Microsoft has released security updates for supported SharePoint versions and recommended enabling the Antimalware Scan Interface (AMSI) integration to help detect malicious requests associated with exploitation attempts.

CISA also advised organizations to follow Microsoft’s incident response guidance, hunt for indicators of compromise, and rotate SharePoint machine keys where appropriate, acknowledging that patching alone may not fully remove attacker persistence from already compromised servers.

Older vulnerabilities remain active entry points

Alongside the newly disclosed flaw, CISA reiterated the urgency of addressing CVE-2026-45659, an insecure deserialization vulnerability allowing RCE that Microsoft had marked as “exploitation less likely” in its advisory in May. Another old bug CISA flagged is CVE-2026-32201, an improper input validation flaw that allows spoofing over a network.

Both of these flaws are being actively exploited in the wild.

CISA called out organizations failing to catch up with SharePoint updates, adding that attackers are increasingly targeting N-days rather than relying exclusively on newly discovered zero-days.

On concerns of patching speed, Boehm noted resilience is becoming an architectural challenge as much as an operational one.

“Stop measuring this in patch speed,” he said. “That’s a race you eventually lose. Some of these landed as zero-days with no fix on day one, and the window between disclosure and exploitation keeps shrinking. So the board-level question isn’t whether a server gets compromised. Assume one will. It’s how much of the business a single-owned system can take down with it.”

Boehm argued that limiting network reachability through segmentation should sit alongside patch management and threat hunting as a core defensive strategy. Reachability, he said, is a control that organizations own, not patch timing. CISA has given Federal Civilian Executive Branch (FCEB) agencies three days to remediate CVE-2026-56164 under Binding Operational Directive (BOD) 22-01.

The article originally appeared on CSO.

Adobe’s Firefly Graph is now available to Creative Cloud customers, offering a node-based workflow tool designed to help business create content at scale with generative AI (genAI). 

With Firefly Graph, users can connect multiple tools in visual workflow, with each “node” performing a specific task before passing its output to the next node. This gives creative professionals more control over generated outputs, according to Adobe, and makes it easier to try out ideas by swapping, adjusting or adding components.

For example, a user could start with a text prompt box that connects to a node that generates an image using an AI model from Adobe or third-parties such as Google and OpenAI. Further along the chain, the user could add nodes to remove a background or upscale an image, for instance, before producing an image, video or other asset ready for use.

Changing one aspect, such as adding a reference image or adapting the text prompt, would change the final output.

It’s an approach similar to node-based workflow tools such as ComfyUI — a startup valued at $500 million which claims more than 4 million users. Others include Weavy, acquired by Figma last year for a reported $200 million. 

With so many AI tools available to creative professionals, workflows can get complex and hard to replicate, said Elliot Sedegah, director for strategy and product marketing at Adobe. Firefly Graph provides access to more than 300 different node types, including images, video editing and AI generation tools across Adobe’s portfolio and third-party tools. 

“Whether you’re working at a mom-and-pop shop or a larger enterprise, you’re looking for consistency and then bringing that into a workflow so that you’re not hopping in and out of different tools,” he said. “Putting all that together takes massive amount of time, and sometimes it’s very difficult to even know what you did.”

Once created, workflows can be shared across an organization as repeatable processes for other individuals or teams to use. “Think of that rock star creative that you have and the recipes they create: those are now canonized as workflows, as assets, that the rest of the organization can take and reuse over and over again,” said Sedegah.

In addition, while creative professionals are needed to created high quality assets, reusable workflows can be put into the hands of broader teams to create content for large audiences, said Sedegah.

Firefly Graph addresses a challenge that most large creative organizations face, said Lisa Gately, principal analyst at Forrester — namely that their best creative workflows “live inside the heads of a few experts.

“Teams can generate images and video with AI, but reproducing the exact sequences of creative decisions, model selections, edits, and refinements that lead to a high-quality result is difficult and inconsistent. Firefly Graph turns those workflows into reusable assets,” she said.

While other node-based workflows aim to address similar problems, Adobe’s pitch is that Firefly Graph provides customers with the benefit of integration into its product suite. 

“Firefly is a full, broader AI creative studio, not just a node-based tool, so [Firefly Graph] is a part of a bigger picture,” said Sedegah. “The strength is having everything in one place with the tools that people know.” 

“Where Adobe differentiates is in enterprise integration,” said Gately, with Adobe connecting Firefly Graph to a range of other Adobe tools. Those include Creative Cloud applications; Firefly Boards for ideation; and Firefly Creative Production. 

“The workflow becomes part of a broader content supply chain instead of a standalone creation tool,” she said. ”Organizations committed to other tools are unlikely to migrate for a node-based canvas — making a change is about the broader content supply chain.”

Firefly Graph is available now to Adobe Creative Cloud for Enterprise subscribers. Creative Cloud for Enterprise is licensed by seat, requiring custom, volume-based enterprise agreements. Creative Cloud for Enterprise customers receive credits for Firefly Graph. Creative Cloud for teams customers can sign up for a public beta online. Creative Cloud pricing starts at $99.99 per license each month.

This article was updated on June 19 with pricing information from Adobe.