October 2026 Patch Tuesday for Financial Institutions

Whoever handles patching at your bank, credit union, or mortgage company has a long list this week. Microsoft's October 2026 Patch Tuesday, the monthly security release it shipped Tuesday, October 13, covers more than 1,400 vulnerabilities. A handful of them deserve your team's first hours, and one is already in attackers' hands.

So the useful question for October 2026 Patch Tuesday is where your team's hours go first. Microsoft answered part of it the same day it shipped the update, with a short post on grouping vulnerabilities by the questions they share. We'll use that idea here, applied to the systems a financial institution actually runs.

Here's the short version: one Windows flaw is exploited, and the Cybersecurity and Infrastructure Security Agency (CISA) set a federal due date of today, Friday, October 16. Five Outlook flaws can run code when someone simply views a message in the Reading Pane. Exchange Server, Active Directory Federation Services (AD FS), and domain controllers each have their own item. And the Windows 11 update itself changes an authentication default that might affect branch Wi-Fi or VPN connections, so it needs a test before it goes everywhere.

October 2026 Patch Tuesday by the numbers

Counts for this release depend on who's counting and when. Each flaw gets a public ID called a CVE (Common Vulnerabilities and Exposures). On release day, Tenable counted 1,407 CVEs, 69 of them rated critical. Microsoft kept adding entries afterward, including Office and SharePoint CVEs it published on October 15 as fixed by the October updates but "inadvertently omitted" from the original list, so its own figure has grown since.

That's more than three times August's total, two months later. Tenable described October as "the second consecutive month to reset the bar as the largest Patch Tuesday release." For a two-person IT team, what matters is what the number does to the calendar: this is where CVE-by-CVE review runs out of hours.

Microsoft's release notes flag two items as notable. CVE-2026-96951 is marked "Exploitation Detected." CVE-2026-108398, a .NET Framework flaw that Microsoft says could let an attacker "bypass Windows Defender Application Control (WDAC) enforcement," was publicly disclosed before the fix. A second disclosed item, a MessagePack-CSharp denial of service rated 5.3, is why some coverage counts three zero-days, meaning flaws public or exploited before a fix, and some counts two.

First: the Windows Shell flaw attackers already use

CVE-2026-96951 is a Windows Shell security feature bypass, rated Important with a severity score of 8.8 on the Common Vulnerability Scoring System (CVSS). It's the only vulnerability in the October release that Microsoft marks as exploited. Tenable notes it's the third Windows Shell flaw exploited in the wild this year, after CVE-2026-21510 in February and CVE-2026-32202 in April.

The security feature it bypasses is Mark of the Web. That's the tag Windows adds to files from an untrusted location, and Microsoft's own example is "browser downloads or email attachments." Office relies on that tag to block macros in files from the internet. Microsoft's description of the flaw is short:

The route in is the most ordinary one a financial institution has: a file sent by email or chat to a staff member, who has to be persuaded to open it. Loan files, statements, and invoices arrive that way all day. A file that loses its Mark of the Web arrives looking local and trusted, which removes the warning your users have been trained to read.

The forensic flag changes the job. Patching closes the hole from today forward. The look-back covers the weeks before your devices took the update. Ask whoever watches your Microsoft Defender alerts to review files that arrived by email or Teams and then launched a script or a command shell in the weeks before your devices installed October's update.

If that's the same two-person IT team doing the patching, Guardian MxDR fills the gap: ABT engineers monitor alerts from Microsoft Defender, Entra ID, and Purview, and on the Guardian rungs that include it, automated containment runs around the clock, including at 2 in the morning. Your team patches, and MxDR watches while the patch rolls out.

Mail-side controls matter more than usual while that review runs. Safe Attachments, part of Microsoft Defender for Office 365 Plan 1 and Plan 2, "uses a virtual environment to check attachments in email messages for harmful attachments" before delivery. Microsoft 365 Business Premium includes Plan 1. Our guide to Safe Attachments and password-protected files covers the settings that decide what reaches an inbox.

Second: five Outlook flaws that fire from the Reading Pane

Five of October's Outlook vulnerabilities are remote code execution flaws rated Critical with a CVSS score of 9.8: CVE-2026-88156, CVE-2026-70242, CVE-2026-70291, CVE-2026-97016, and CVE-2026-97749. They affect Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024, and two of them also affect Office for Mac. Microsoft gives all five the same description.

The Reading Pane is the preview area where Outlook shows a message when you select it. Word has a sixth flaw in the same family: CVE-2026-70300, also 9.8, triggers "when Microsoft Word processes the document in the Reading Pane; the user does not need to open the document."

Keep the urgency in proportion. Microsoft rates all five Outlook flaws "Exploitation Less Likely," and none is on CISA's catalog. The reason they belong near the top of your list is the delivery method. Any outside sender can put a message in a loan officer's inbox, and these flaws need nothing from the recipient beyond looking at it.

The fix arrives through Microsoft 365 Apps, on whatever update channel each device uses. The work for your team is confirming that devices actually reached a fixed build. Microsoft lists the October 13 builds by channel:

Devices on a deferred or held-back channel, shared workstations that rarely restart, and branch PCs that run Office from an older image are where these builds tend to lag. If your institution still runs Office 2021 or Office LTSC 2021, our October 2026 end of support guide covers what changed on October 13 for those versions.

Third: Exchange Server, AD FS, and domain controllers

Most of October's server work lands on three roles that many financial institutions still run on premises, often as the last pieces of an otherwise cloud environment.

Exchange Server. Microsoft released October security updates for Exchange Server Subscription Edition, Exchange Server 2019 CU14 and CU15, and Exchange Server 2016 CU23; the 2019 and 2016 updates require enrollment in Microsoft's Period 2 Extended Security Update program. Three of the seven Exchange CVEs are rated "Exploitation More Likely." They include CVE-2026-70279, a spoofing flaw scored 9.3 that acts with an administrator's privileges if that administrator clicks a crafted link, and CVE-2026-70571, a remote code execution flaw scored 8.1 that a crafted email can trigger.

Exchange Online customers are covered for these flaws already. The Exchange Team's words: Exchange Online customers "do not need to take any action other than updating any Exchange servers or Exchange Management tools workstations in their environment." That exception matters for hybrid institutions, because the Exchange Team says the update "needs to be installed on your Exchange servers, even if they are used only for management purposes."

Two more Exchange facts belong in this month's plan. October is the last month of Period 2 Extended Security Updates for Exchange 2016 and 2019, and Microsoft says it will "stop testing Exchange 2016 and 2019 for vulnerabilities." On October 15, the Exchange Team added a banner about Outlook on the web (OWA): the October Windows Server updates "can cause Exchange Server OWA to fail," with an error naming MapiExceptionMdbOffline and growing email queues. That can happen whether or not you install the Exchange update, and Microsoft is investigating with its Windows team.

AD FS. CVE-2026-96252 is an AD FS spoofing flaw scored 9.1 that involves the signed sign-in messages called Security Assertion Markup Language (SAML) responses. Microsoft says an unauthenticated attacker "could relay a validly signed SAML response intended for a different endpoint" and "obtain tokens," with no user interaction required. The fix ships inside the Windows Server cumulative updates, so the AD FS servers need the same Windows update as everything else.

Domain controllers. CVE-2026-70229 is a remote code execution flaw in Active Directory Domain Services, rated Critical with a score of 8.1 and "Exploitation More Likely." An unauthenticated attacker sends a specially crafted packet over the network. Microsoft scores the attack complexity as high and still rates exploitation more likely, so domain controllers belong early in the window, after a test. Our May 2026 Patch Tuesday guide covers patching domain controllers that Intune doesn't manage.

What to test before you push the Windows update

Speed matters this month, and so does a pilot ring. Three items from Microsoft's own notes can turn a fast rollout into a Monday help desk queue, and each one shows up first at a branch or in the server room.

The NTLMv1 change is the one most likely to surprise a branch network. Wireless and VPN setups that authenticate with MS-CHAPv2 are the connections Microsoft says the change might affect. Put one laptop from each branch type and one VPN user in your first ring, and confirm they connect after the restart.

Intune update rings exist for exactly this. Microsoft's Intune documentation says rings control "deferral periods, restart settings, deadlines, active hours, and user notifications," and a ring can be paused for up to 35 days if testing finds a problem. A pilot ring that takes the update today and a broad ring that follows once the pilot connects cleanly is a schedule most institutions can hold, even in a heavy month.

Work the rest the way Microsoft suggests

After those items, you still have well over a thousand CVEs. On October 13, the Microsoft Security Response Center published an exploratory way to work through them. It groups vulnerabilities by the question you'd ask about your own environment, so you answer each question once and reuse the answer for every CVE that shares it.

Microsoft's post sketches 15 illustrative cohorts and calls them "a starting point." Its Office row asks the question this article has been working through: "Which Office applications and versions are installed, what untrusted content reaches them, and how are Office updates deployed?"

For a bank, credit union, or mortgage company, five questions are a good place to start:

Answer each once, write the answer down, and use it as the starting point for every CVE in that group. Microsoft's own step four still applies to the exceptions: "Continue to prioritize individual vulnerabilities based on active exploitation, severity, attack vector, required privileges, user interaction, and product-specific guidance."

Where October's hours go: the exploited flaw and the pilot ring first, the Office builds and servers within the week, everything else by shared question.

The order we would work October

Put the pieces together and October has a clear order. Exploitation status and delivery method come first, then the servers, then everything else through your normal process.

Steps one and two come first. Steps three and four follow within the week. Step five is how October stops being a fire drill and becomes routine maintenance.

What to put in the record for your board and examiners

A month this size is a good test of whether your patch evidence holds up. When an examiner or your board asks how October went, four records go a long way toward answering it: the date each ring took the Windows update, the build check for Microsoft 365 Apps, the result of the CVE-2026-96951 look-back, and the cohort answers that explain why the rest followed your normal schedule.

That last record is the easiest one to leave out, and it's the one that makes a 1,400-item month defensible. "We patched what mattered first" is a claim. A written answer to "which of our servers face the internet," dated this week, is evidence.

Guardian MxDR covers the detection side of that record. It writes an incident report when a threat is detected and resolved, and Security Insights rolls those incidents up with Secure Score trends and multifactor authentication coverage into a monthly report your examiner can review.

Four records that help answer your board and examiners on October: ring dates, the Office build check, the look-back, and your cohort answers.

How ABT and Guardian MxDR cover the patch window

ABT has served more than 750 financial institutions over 25 years. We're a Tier-1 Microsoft Cloud Solution Provider primarily dedicated to financial services, and we manage our clients' Microsoft 365 tenants under the delegated access they grant. In a month like October, the work splits in two: knowing where every device stands, and watching closely while the patch window is open.

Detection matters most while the update is still rolling out, because October's exploited flaw arrives by email or chat and runs on a Windows device. Guardian MxDR is the managed detection and response side of ABT's Guardian operating model, and you choose how far ABT goes.

Guardian Contain adds round-the-clock detection across identity, endpoint, email, and cloud apps on Microsoft Defender XDR signals, with pre-authorized automated containment that revokes a compromised session in seconds at any hour. Guardian Respond puts ABT security engineers on covered incidents during business hours, and Guardian Resolve has a human on the incident at any hour. From Respond up, each covered incident gets a written timeline suitable for an examiner or an insurer.

ABT's Microsoft 365 security assessment is the place to start. It reviews Intune enrollment, compliance policies, OS patch levels, and encryption settings across managed and unmanaged devices, the device inventory your Windows and Office cohort answers start from. Most assessments finish within two weeks, so you can have that baseline in hand before November's Patch Tuesday.

Frequently Asked Questions