# Microsoft Patch Tuesday fixes exploited zero-day

Published: 2026-10-13 · Severity: high · Sectors: government-national, technology
Canonical: https://vorant.io/reports/ff7f9467-fe79-52b8-a42c-eac26d7cf6d8/microsoft-patch-tuesday-fixes-exploited-zero-day

> Microsoft's October 2026 Patch Tuesday addresses multiple RCE flaws, including CVE-2026-96951, which is confirmed to be exploited in the wild.

This is the MS-ISAC/CIS advisory summarizing Microsoft's October 13, 2026 Patch Tuesday release. Multiple vulnerabilities were disclosed across Windows, Office, SharePoint Server, SQL Server, Exchange Server, Developer Tools (Dev Div), Azure, Defender, and Edge. The most severe issues could allow remote code execution, giving an attacker the same privileges as the logged-on user — potentially enabling installation of programs, data manipulation or deletion, or creation of new accounts with full rights. Impact is reduced for accounts operating with least-privilege configurations.

Microsoft has confirmed that CVE-2026-96951 is being actively exploited in the wild, making it the priority patch for this cycle. The advisory does not provide technical detail on the exploitation vector or the specific product affected by this CVE within the broader list; the full enumeration of vulnerabilities is referenced in Microsoft's own release notes.

CIS/MS-ISAC recommends standard patch management practices: prompt testing and deployment of updates, vulnerability scanning, least-privilege enforcement, network segmentation, and anti-exploitation features (DEP, Windows Defender Exploit Guard). Given the breadth of affected products (core OS, server infrastructure, cloud, email, browser) and the presence of an actively exploited vulnerability, defenders should prioritize patching of internet-facing and high-value systems first, particularly Exchange Server, SharePoint Server, and Windows endpoints.

## Mentioned in this report

- Vulnerabilities: CVE-2026-96951 (KEV)

## Detection guidance (public sample)

### Office Application Spawning Command Interpreter or Script Host

ATT&CK: T1203

Office applications or Edge-hosted content handlers spawning cmd, PowerShell, or script hosts, a common post-exploitation pattern for client-side RCE. Generic hunting rule, not tied to a specific CVE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Office Application Spawning Command Interpreter or Script Host
description: Detects Microsoft Office processes spawning shells or script hosts, a
  typical outcome of successful client-side exploitation (T1203). The advisory gives
  no CVE-specific technical detail, so this rule generalises on the parent/child relation
  rather than any exploit artefact.
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \WINWORD.EXE
    - \EXCEL.EXE
    - \POWERPNT.EXE
    - \OUTLOOK.EXE
    - \MSPUB.EXE
    - \VISIO.EXE
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \regsvr32.exe
    - \rundll32.exe
    - \bitsadmin.exe
  condition: selection
falsepositives:
- Office macros or add-ins in some organisations that legitimately launch cmd or PowerShell
  for automation
- Outlook rules or helper tools launching scripts for line-of-business workflows
level: medium
id: 45c32020-ca8d-5268-a1fb-8956a782dd0f
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-october-13-2026_2026-114
```

### IIS Worker Process Spawning Shell on Exchange or SharePoint Server

ATT&CK: T1203

w3wp.exe spawning cmd, PowerShell, or common LOLBins, indicating possible server-side RCE exploitation of Exchange or SharePoint. Generic hunting rule, not tied to a specific CVE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: IIS Worker Process Spawning Shell on Exchange or SharePoint Server
description: Detects the IIS worker process w3wp.exe spawning command interpreters
  or download/execution utilities, a common result of exploiting RCE flaws in Exchange
  or SharePoint. The advisory names these products as high-priority but gives no vector,
  so this generalises on the parent/child relation.
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \w3wp.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \rundll32.exe
    - \regsvr32.exe
  condition: selection
falsepositives:
- Web applications or admin portals that legitimately shell out to cmd or PowerShell
- Exchange or SharePoint health and maintenance scripts invoked from an application
  pool
level: high
id: 45142499-7833-5bde-9024-a9e87226e7a4
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-october-13-2026_2026-114
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-october-13-2026_2026-114

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/ff7f9467-fe79-52b8-a42c-eac26d7cf6d8/microsoft-patch-tuesday-fixes-exploited-zero-day.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup