Microsoft released its October 2026 security updates on 13 October. One of the flaws fixed is already being used by attackers, and several others affect Outlook, Excel and Exchange, the tools most offices rely on every day. Here is what matters for businesses in Hong Kong and Singapore, and what to update first.
The short version
- Install this month's Windows updates promptly. They fix a Windows Shell flaw that attackers are already exploiting.
- Update Microsoft 365 Apps and Office, especially Outlook: two critical Outlook flaws can be triggered just by viewing an email in the Reading Pane.
- If you run your own Exchange Server, apply the October Exchange update as well.
How big is this month's release?
Microsoft's October release covers 1,417 vulnerabilities in its own products, 76 of them rated Critical. The update listing also includes fixes for third-party components that Microsoft ships, such as Linux and Apache, which is why some reports quote a higher total.
Most of the fixes are rated Important. The largest groups are elevation of privilege flaws, which let someone who already has a foothold gain more control, and remote code execution flaws, which can let an attacker run their own code on a device or server.
Actively exploited: Windows Shell (CVE-2026-96951)
This is the flaw to act on first. According to Microsoft, it lets an attacker get around Mark of the Web, the label Windows puts on files that come from the internet or email. That label is what triggers the extra warnings and protections when someone opens a downloaded file.
Microsoft describes the attack as a specially crafted file sent by email or instant message. The attacker still has to persuade someone to open it, which is exactly what phishing emails are designed to do.
Microsoft marks this flaw as exploited, and the US Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalogue on 13 October, giving US federal agencies until 16 October to fix it. That short deadline shows how seriously it is being treated.
Also critical this month
Outlook: a risk from simply reading an email
Microsoft rates two Outlook flaws (CVE-2026-70242 and CVE-2026-97016) as Critical. In Microsoft's words, simply viewing a specially crafted message in the Outlook Reading Pane could trigger them, without the recipient opening the message or clicking anything. Updating Outlook removes the risk.
Excel and other Office apps
Critical fixes for Excel, PowerPoint, Word and Visio cover malicious files that a user would have to open. Microsoft notes that the Excel updates for Office LTSC for Mac 2021 and 2024 were not immediately available, so Mac users on those versions should watch for the update.
Exchange Server (on-premises only)
A critical Exchange Server flaw (CVE-2026-70571) could let an attacker run code on the server by sending a specially crafted email. Microsoft says exploiting it needs a deep understanding of the target, but an email server facing the internet should not wait. Exchange Online customers do not need to install anything for this one.
Servers in the office
If you run Windows servers, note the critical fixes for DHCP Server, Remote Desktop Gateway, Active Directory Federation Services (AD FS) and Hyper-V. Several can be triggered over the network without signing in, although Microsoft rates some of them as hard to exploit.
What to update first
- Windows on every PC, laptop and server, for the exploited Windows Shell flaw.
- Microsoft 365 Apps or Office, with Outlook as the priority.
- Exchange Server, if you run your own.
- Windows servers with the DHCP Server, Remote Desktop Gateway, AD FS or Hyper-V roles.
- .NET Framework, which includes a publicly disclosed flaw (CVE-2026-108398) that could let someone with access get around Windows Defender Application Control.
Restart devices after updating. Many Windows and Office updates only take effect after a restart, and laptops that are put to sleep rather than shut down can go weeks without one.
For Microsoft 365 and Intune admins
- In the Intune admin centre, check that your Windows update rings deliver this month's quality update without a long deferral, and look at the update reports for devices that have not installed it.
- Check which Microsoft 365 Apps update channel your devices use. Devices on a slower channel receive Office fixes later.
- Remind staff to restart, or set a deadline in your update policy so devices restart automatically.
- Windows 10 devices only receive these fixes if they are enrolled in Microsoft's paid Extended Security Updates programme. Our guide to when to replace business laptops and desktops covers what to do with older devices.
Frequently asked questions
Our updates install automatically. Do we need to do anything?
Check that they actually installed and that devices have restarted. Automatic updates often wait for a restart, and devices that are rarely restarted can stay unprotected for weeks.
Do we need to update anything for Microsoft 365 in the cloud?
Microsoft fixes its own cloud services. What you need to update are the apps installed on your devices, such as Outlook and Excel, Windows itself, and any servers you run in your office or data centre.
What is Mark of the Web?
It is a label Windows adds to files downloaded from the internet or received by email. It tells Windows and Office to treat the file with extra caution, for example by opening Office documents in Protected View. The exploited flaw this month lets attackers get around that label.
Sources and further reading
- Microsoft Security Update Guide: October 2026 release notes
- Microsoft Security Update Guide: CVE-2026-96951
- CISA: Known Exploited Vulnerabilities catalogue
If you are not sure whether your devices and servers have this month's updates, our managed IT services team keeps Windows, Microsoft 365 Apps and servers patched for you, and our cybersecurity team can check your exposure. Talk to our team.
