CVE-2026-96951: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') in Microsoft Outlook.com

69 Critical 1337 Important 0 Moderate 1 Low Microsoft addresses 1407 CVEs in the tenth Patch Tuesday of 2026, marking the second consecutive month to reset the bar as the largest Patch Tuesday release. This month’s updates include patches for two zero days, including one that was exploited in the wild. Microsoft patched 1,407 CVEs in its October 2026 Patch Tuesday release, with 69 rated critical, 1,337 rated as important, and one rated as low. This month’s update includes patches for 301 products and components. The following table lists the products with the most CVEs patched this month. A full list of patched products is available in the appendix. Rank Product CVE Count 1 Microsoft Office Excel 69 2 Role: DNS Server 52 3 Windows Kernel 46 4 Windows Installer 38 5 Windows Win32 Kernel Subsystem 36 6 Microsoft Office SharePoint 34 7 Microsoft Windows Search Component 29 8 Windows NTFS 26 9 .NET 25 10 (Tie) Microsoft Office Word 22 10 (Tie) SQL Server 22 10 (Tie) Windows Error Reporting 22 Elevation of Privilege (EoP) vulnerabilities accounted for 47.9% of the vulnerabilities patched this month, followed by remote code execution (RCE) vulnerabilities at 22.3%. Important CVE-2026-96951 | Windows Shell security feature bypass vulnerability CVE-2026-96951 is a security feature bypass vulnerability affecting Windows Shell. It received a CVSSv3 score of 8.8 and was rated as important. According to Microsoft, this vulnerability was exploited in the wild as a zero-day. An attacker could exploit this vulnerability using social engineering tactics, via email or messages, to convince their target to open a malicious file. Successful exploitation would bypass the Mark of the Web (MOTW) security feature. This is the third flaw in Windows Shell that was exploited in the wild in 2026: CVE-2026-21510 was patched in February 2026’s Patch Tuesday while CVE-2026-32202 was patched in April 2026’s Patch Tuesday . Important CVE-2026-108398 |.NET Framework security feature bypass vulnerability CVE-2026-108398 is a security feature bypass vulnerability affecting.NET Framework. It received a CVSSv3 score of 8.8 and is rated as important. It was publicly disclosed prior to a patch being available. An attacker could exploit this vulnerability by registering a malicious.NET assembly on a vulnerable system to be loaded by a protected process. Successful exploitation would allow the attacker to bypass Windows Defender Application Control (WDAC). Critical CVE-2026-70229 | Windows Active Directory Domain Services remote code execution vulnerability CVE-2026-70229 is an RCE vulnerability affecting Windows Active Directory Domain Services (AD DS). It received a CVSSv3 score of 8.1 and is rated as critical. Microsoft assesses this vulnerability as “Exploitation More Likely” according to Microsoft’s Exploitability Index . An attacker could exploit this vulnerability by sending a crafted packet to the vulnerable AD DS service. Successful exploitation could grant an attacker code execution on the vulnerable system. Important CVE-2026-70279 | Microsoft Exchange Server spoofing vulnerability CVE-2026-70279 is a spoofing vulnerability affecting Microsoft Exchange Server. It received a CVSSv3 score of 9.3 and is rated as important. It was assessed as “Exploitation More Likely.” An attacker could exploit this vulnerability by convincing a target through social engineering to click on a malicious link. Successful exploitation against a target with administrative privileges would allow an attacker to access or modify organizational data. Critical CVE-2026-70571 | Microsoft Exchange Server remote code execution vulnerability CVE-2026-70571 is a remote code execution vulnerability affecting Microsoft Exchange Server. It received a CVSSv3 score of 8.1 and is rated as critical. It was assessed as “Exploitation More Likely.” An attacker could exploit this vulnerability by sending a malicious email to a vulnerable Microsoft Exchange server that would cause it to process the em…