Microsoft Patch Tuesday fixes exploited zero-day
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Microsoft's October 2026 Patch Tuesday addresses multiple RCE flaws, including CVE-2026-96951, which is confirmed to be exploited in the wild.
This is the MS-ISAC/CIS advisory summarizing Microsoft's October 13, 2026 Patch Tuesday release. Multiple vulnerabilities were disclosed across Windows, Office, SharePoint Server, SQL Server, Exchange Server, Developer Tools (Dev Div), Azure, Defender, and Edge. The most severe issues could allow remote code execution, giving an attacker the same privileges as the logged-on user — potentially enabling installation of programs, data manipulation or deletion, or creation of new accounts with full rights. Impact is reduced for accounts operating with least-privilege configurations.
Microsoft has confirmed that CVE-2026-96951 is being actively exploited in the wild, making it the priority patch for this cycle. The advisory does not provide technical detail on the exploitation vector or the specific product affected by this CVE within the broader list; the full enumeration of vulnerabilities is referenced in Microsoft's own release notes.
CIS/MS-ISAC recommends standard patch management practices: prompt testing and deployment of updates, vulnerability scanning, least-privilege enforcement, network segmentation, and anti-exploitation features (DEP, Windows Defender Exploit Guard). Given the breadth of affected products (core OS, server infrastructure, cloud, email, browser) and the presence of an actively exploited vulnerability, defenders should prioritize patching of internet-facing and high-value systems first, particularly Exchange Server, SharePoint Server, and Windows endpoints.
Mentioned in this report
Detection guidance
Office Application Spawning Command Interpreter or Script Host
Office applications or Edge-hosted content handlers spawning cmd, PowerShell, or script hosts, a common post-exploitation pattern for client-side RCE. Generic hunting rule, not tied to a specific CVE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Office Application Spawning Command Interpreter or Script Host
description: Detects Microsoft Office processes spawning shells or script hosts, a
typical outcome of successful client-side exploitation (T1203). The advisory gives
no CVE-specific technical detail, so this rule generalises on the parent/child relation
rather than any exploit artefact.
tags:
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \WINWORD.EXE
- \EXCEL.EXE
- \POWERPNT.EXE
- \OUTLOOK.EXE
- \MSPUB.EXE
- \VISIO.EXE
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \regsvr32.exe
- \rundll32.exe
- \bitsadmin.exe
condition: selection
falsepositives:
- Office macros or add-ins in some organisations that legitimately launch cmd or PowerShell
for automation
- Outlook rules or helper tools launching scripts for line-of-business workflows
level: medium
id: 45c32020-ca8d-5268-a1fb-8956a782dd0f
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-october-13-2026_2026-114
IIS Worker Process Spawning Shell on Exchange or SharePoint Server
w3wp.exe spawning cmd, PowerShell, or common LOLBins, indicating possible server-side RCE exploitation of Exchange or SharePoint. Generic hunting rule, not tied to a specific CVE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: IIS Worker Process Spawning Shell on Exchange or SharePoint Server
description: Detects the IIS worker process w3wp.exe spawning command interpreters
or download/execution utilities, a common result of exploiting RCE flaws in Exchange
or SharePoint. The advisory names these products as high-priority but gives no vector,
so this generalises on the parent/child relation.
tags:
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \w3wp.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \certutil.exe
- \bitsadmin.exe
- \rundll32.exe
- \regsvr32.exe
condition: selection
falsepositives:
- Web applications or admin portals that legitimately shell out to cmd or PowerShell
- Exchange or SharePoint health and maintenance scripts invoked from an application
pool
level: high
id: 45142499-7833-5bde-9024-a9e87226e7a4
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-october-13-2026_2026-114
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-october-13-2026_2026-114
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs