A Windows Warning Can Be Bypassed
CVE-2026-96951 affects Windows Shell, the part of Windows that manages the desktop and the file interface. Attackers are already exploiting it. Microsoft rates it Important, with a severity score of 8.8 out of 10.
The flaw bypasses Mark of the Web. Mark of the Web is a marker that tells Windows and installed applications a file came from the internet. That marker is what triggers extra security prompts and warnings.
A malicious file can skip that warning and reach a user without raising any flag. A typical delivery path is an email or instant message that convinces someone to open the file. The user still has to open the file for the attack to work.
This fix should be the first priority on any affected Windows computer. A warning that never appears cannot help anyone make a safe decision.
Outlook Can Be Attacked Through a Preview
Outlook carries five especially serious remote code execution flaws this month. They are CVE-2026-70242, CVE-2026-70291, CVE-2026-88156, CVE-2026-97016, and CVE-2026-97749. Each one scores 9.8 out of 10 for severity, near the top of the scale.
Remote code execution means an attacker may be able to make Outlook run their instructions instead of the user’s own commands. Flaws of this kind have a history of triggering through Outlook’s reading pane. Simply displaying a malicious email in preview can be enough. The user may never need to open an attachment.
That makes these Outlook updates a high priority wherever Outlook is installed. Microsoft’s Office release notes list the fixes by update channel and version. Administrators should check the installed Office build and the Windows update status separately.
The practical lesson is simple. Email software can process dangerous content before a user ever deliberately opens anything.
Two Servers Need Fast Attention
CVE-2026-70571 affects Microsoft Exchange Server. Once an affected server processes a specially crafted email, the flaw can let an attacker run code on that server. Exchange handles incoming mail automatically, so no user needs to click anything for this one to fire.
CVE-2026-70229 affects Active Directory Domain Services, the component behind domain controllers and centralized access management. Microsoft rates both this flaw and the Exchange flaw as more likely to be exploited soon. That is a risk assessment, not proof that either has been used in an attack yet.
Organizations should identify which servers run Exchange or host domain controllers, then prioritize patching by exposure. A server reachable from the internet, or from untrusted networks, should move to the front of the line. Internal domain controllers still need prompt attention, given how central they are to the rest of the network.
A Public Flaw in Application Control
CVE-2026-108398 affects the .NET Framework. It lets an attacker who already has local access on a machine bypass Windows Defender Application Control, a security boundary meant to limit which code is allowed to run. The method involves registering a malicious .NET component that a protected process then loads.
This flaw was publicly disclosed before Microsoft’s fix was ready. That is different from being actively exploited. It still deserves its own line in the patch queue, tracked separately from the Windows Shell flaw already under attack.
Virtual Machines Are Also Affected
CVE-2026-102214 and CVE-2026-105733 both affect Hyper-V, each scoring 8.8 for severity. Both describe a path from code running inside a guest virtual machine to code execution on the host machine itself.
This matters most where several virtual machines share one physical server. The host is what keeps those machines separated from each other. A flaw at that boundary can affect every guest on the box, not just the one where the attack started.
Patch in Order of Real Exposure
The Windows Shell flaw already under attack is the clear starting point. Affected Outlook installations and exposed server services should follow close behind.
A short test cycle on the relevant updates, followed by a prompt wider rollout, works better than waiting for one single mass deployment. Confirm which systems need a restart and which versions are actually installed. Check Windows, Office, server products, and application dependencies as separate checklists, not one combined task.
A count above 1,400 does not mean 1,400 separate installations. Many fixes ship together inside single product updates. The real work is identifying which systems are affected, testing the right packages, and finishing the rollout.
October’s release makes one thing clear. A severity label by itself does not tell the whole story. A flaw rated only Important is already being exploited, while several Critical-rated flaws have no confirmed attacks yet. Email flaws can trigger from a preview alone, before anyone opens anything. Patch order should follow the real attack paths, not the label alone.