October 2026 Attack Surface Analysis

Preview Pane-triggered exploitation dominates this release with 23 CVEs across Office applications including Excel, PowerPoint, and Visio. These flaws require minimal user interaction; a victim could simply view a malicious file in the Reading Pane or file explorer preview, eliminating the traditional click-to-compromise barrier that many enterprises rely on as a user training backstop. The attack surface is substantial; any user who receives a weaponized document via download can trigger code execution simply by selecting the file. This class of flaw has historically been attractive to phishing operators and initial access brokers because it converts document delivery into reliable code execution without requiring macro enablement or a user opening the file.

Unauthenticated network-reachable RCE vulnerabilities appear across 15 CVEs this month, spanning Dynamic Host Configuration Protocol (DHCP) Server, Microsoft Quick UDP Internet Connections (QUIC), PostScript Printer Driver, and PDF handling components. These flaws allow remote attackers to execute code without authentication, making them high-value targets for lateral movement and initial network compromise. DHCP servers in particular are deployed on internal networks by design and trust inbound traffic from any client requesting an address. CVE-2026-100219 and CVE-2026-105016 in Microsoft QUIC represent exposure on any service using QUIC transport, which is increasingly common in modern web infrastructure.

Identity platform components carry critical vulnerabilities this month, with RCE and spoofing flaws affecting both Active Directory Domain Services (AD DS) and Active Directory Federation Services (AD FS). CVE-2026-70229 in AD DS enables RCE against domain controllers, while CVE-2026-108131 and CVE-2026-96222 in AD FS present spoofing risks that could enable federated authentication bypass. Compromise of these components can propagate across the entire domain or break trust boundaries between federated identity providers. Similar identity fabric flaws have historically been targeted by advanced adversaries seeking persistent access to enterprise environments.

Microsoft Outlook alone accounts for five critical RCE vulnerabilities this month, including CVE-2026-70242 and CVE-2026-70291, reinforcing email as a persistent high-value attack vector. Outlook's position as the default mail client in most enterprise environments and its deep integration with Exchange and Microsoft 365 services means weaponized messages can reach nearly every employee.

Exploited Zero-Day in Windows Shell

CVE-2026-96951 is an Important security feature bypass vulnerability in Windows Shell and has a CVSS score of 8.8. Microsoft confirms the flaw is being exploited in the wild. Successful exploitation allows an attacker to evade Mark of the Web (MOTW) defenses, the trust boundary mechanism that triggers Protected View in Office documents and SmartScreen warnings for downloaded executables.

The attack vector is social engineering: an attacker delivers a specially crafted file via email, instant message, or web download, and a user must open or click the malicious content. Unlike preview pane vulnerabilities, this flaw requires explicit user action. The security control being bypassed is precisely the one designed to warn users before that action becomes dangerous. Once MOTW is stripped, downstream defenses that rely on the zone tag, including SmartScreen, Office Protected View, and Application Guard, no longer apply.

Windows Shell is present on every Windows endpoint, so the exposed population is effectively the entire Windows install base. The practical impact is that payloads delivered through phishing or watering hole campaigns can execute without the friction that MOTW-aware defenses normally impose. MOTW bypass flaws have historically been attractive to phishing operators and initial access brokers because they reduce the number of warning dialogs a target must dismiss before payload execution.

Publicly Disclosed Vulnerability in .NET Framework

CVE-2026-108398 is an Important security feature bypass vulnerability in .NET Framework and has a CVSS score of 8.8. Microsoft confirms the vulnerability had been publicly disclosed. An authenticated attacker with local access can place a specially crafted .NET assembly on an affected system and register it for loading by a protected process. Successful exploitation bypasses Windows Defender Application Control (WDAC) enforcement, allowing execution of unauthorized code within a protected process context. No user interaction is required.

The attack surface is constrained by the requirement for local authenticated access, but the scope of impact is significant. WDAC is a trust boundary that enterprises deploy specifically to prevent execution of unsigned or unapproved binaries, particularly on high-value systems such as administrative workstations, kiosks, and hardened servers. A bypass that allows an attacker to run arbitrary code inside a WDAC-protected process negates the control entirely for that host, converting a local authenticated foothold into unrestricted code execution despite explicit application allowlist policy.

.NET Framework is installed on virtually every Windows system in the enterprise, which means the vulnerable component is present even where WDAC is not actively enforced. For organizations that rely on WDAC as a compensating control on sensitive endpoints, the combination of public disclosure, no user interaction, and trust boundary bypass makes this flaw more consequential than its Important rating suggests in those environments.

Publicly Disclosed Vulnerability in MessagePack-CSharp

CVE-2026-92707 is a Moderate publicly disclosed denial of service vulnerability in MessagePack-CSharp and has a CVSS score of 5.3. MessagePack-CSharp is a popular binary serialization library for .NET applications. The flaw involves improperly controlled sequential memory allocation, which allows an unauthenticated attacker to exhaust memory resources over a network by sending crafted MessagePack payloads.

The attack surface depends on how the library is deployed. MessagePack-CSharp is commonly used in web APIs, microservices, and real-time communication layers where compact binary serialization offers performance advantages over JSON. Any application that deserializes MessagePack input from untrusted sources, such as public-facing REST endpoints, WebSocket handlers, or message queue consumers, is potentially exposed. The library itself is a NuGet dependency rather than a Windows component, so affected deployments may not be obvious from OS-level inventory alone.

The scope of impact is service availability rather than code execution or data disclosure. For applications that process high volumes of external requests, a memory exhaustion condition can cascade into broader outages if the affected service shares resources with other workloads or lacks adequate isolation.

Remote Code Execution Vulnerabilities in Microsoft Office

This month includes 20 Critical RCE vulnerabilities across Excel, PowerPoint, Visio, and Word, with CVSS scores ranging from 7.5 to 9.8. Six of them list the Preview Pane as an attack vector, and all six are in PowerPoint or Word: CVE-2026-88178 (PowerPoint, CVSS 9.8), CVE-2026-70215 and CVE-2026-88144 (PowerPoint, CVSS 8.8), CVE-2026-70269 and CVE-2026-88185 (Word, CVSS 8.1), and CVE-2026-88207 (PowerPoint, CVSS 7.5). A malicious file can trigger these when a user views it in the Preview Pane without opening it. CVE-2026-88178 is the most severe of the group. Microsoft states that an unauthenticated attacker could exploit it by submitting a crafted presentation to an affected Office Online service, with no authentication or user interaction required. 

The remaining 14 are the 11 Excel and three Visio vulnerabilities, all rated CVSS 8.8. Microsoft states the Preview Pane is not an attack vector for any of them.

The volume and consistency of memory corruption classes (use-after-free, heap-based buffer overflow, out-of-bounds read, integer overflow or underflow) across four Office applications points to broad file-parser exposure. Microsoft Office is deployed on virtually every enterprise endpoint, and phishing operators have historically shown sustained interest in Office-based initial access chains.

Critical Remote Code Execution Vulnerabilities in Microsoft Outlook

CVE-2026-70242, CVE-2026-70291, CVE-2026-88156, CVE-2026-97016, and CVE-2026-97749 are Critical RCE vulnerabilities in Microsoft Outlook, each carrying a CVSS score of 9.8. These flaws include heap-based buffer overflows (CWE-122), a stack-based buffer overflow (CWE-121), and a double free condition (CWE-415), all reachable over the network without authentication. For CVE-2026-70291 and CVE-2026-88156, Microsoft explicitly lists the Preview Pane as an attack vector. An attacker can send a specially crafted email to a target, and simply viewing the message in the Outlook Reading Pane could trigger code execution, without the recipient opening the message or clicking anything. Neither authentication nor user interaction is required.

The attack surface here is effectively every mailbox in an organization. Outlook is a dominant enterprise email client, installed on many corporate endpoints and configured by default to render incoming mail in the Reading Pane. Disabling the Reading Pane imposes a significant productivity cost that many enterprises do not accept, leaving the exposure in place across the user population.

Scope of impact extends beyond the individual workstation. Outlook runs in the context of the logged-in user, so successful exploitation gives an attacker a foothold with that user's credentials, cached tokens, and access to any resources the user can reach.