October Patch Tuesday: Six Critical Remote Code Execution Flaws in Outlook and Exchange

Patch Tuesday, 13 October 2026, was a heavier release than usual for anyone running Outlook or Exchange Server. According to Cisco Talos’s monthly round-up and the Zero Day Initiative’s own analysis of the release, Microsoft shipped fixes for five independent critical remote code execution bugs in the Outlook client — CVE-2026-70242, CVE-2026-70291, CVE-2026-88156, CVE-2026-97016 and CVE-2026-97749 — each scored 9.8 on the CVSS scale, plus one critical RCE in Exchange Server, CVE-2026-70571, scored 8.1 and triggered by a specially crafted email during content conversion on the server side.

Why five 9.8s in one release is unusual

A typical Patch Tuesday spreads its critical bugs across a wide range of products — a browser engine here, a server role there — so it’s unusual to see five unrelated, independently discovered memory-corruption bugs (heap overflows, a stack overflow and a double-free) all land in the same client application in a single month. Outlook is also about as universal an attack surface as exists in a business: almost every employee opens it, every day, without a second thought, and most of these bugs can be triggered just by a message being processed, with no click required from the person reading it. That combination — maximum severity, a very large population of targets, and minimal user interaction — is exactly why security researchers flagged this release as worth acting on quickly rather than filing away for the usual monthly update cycle.

What’s patched

• CVE-2026-70242, CVE-2026-70291, CVE-2026-88156, CVE-2026-97016 and CVE-2026-97749 — five separate Outlook remote code execution bugs (heap overflows, a stack overflow, and a double-free), each rated Critical with a CVSS score of 9.8.
• CVE-2026-70571 — a stack-based buffer overflow in Exchange Server leading to remote code execution via a crafted email processed during content conversion, rated Critical with a CVSS score of 8.1. Microsoft’s own advisory rates exploitation of this one as “more likely.”

None exploited yet — that’s not the same as “not urgent”

As of this release, none of the six Outlook or Exchange CVEs above are confirmed as exploited in the wild. The one bug Microsoft does list as under active attack this cycle, CVE-2026-96951, is an unrelated Windows Shell security-feature-bypass issue with nothing to do with email. That’s genuinely good news, but it describes today, not next week. Once a patch ships, attackers routinely diff the updated binaries against the previous version to work out exactly what changed and build a working exploit from the difference — a process that, for well-understood bug classes like buffer overflows, can take days rather than months. The safe window to patch calmly is now, before that reverse-engineering catches up, not after the first exploitation report appears.

What to check this week

• Confirm Microsoft 365 Apps (the desktop Outlook client) has actually picked up the October update — Monthly Enterprise Channel devices update automatically, but any device that’s been offline, deferred, or managed through Intune/WSUS with a delay policy can fall behind without anyone noticing.
• If you run an on-premises or hybrid Exchange Server — even one kept around purely to manage a hybrid connection to Microsoft 365 — confirm the October cumulative update and this security update are both applied. A hybrid Exchange server is a bridge into your cloud tenant, so patching it matters even if most mailboxes have already moved to the cloud.
• Check for laptops or remote devices that haven’t checked in with your update management tool recently — these are the ones most likely to still be running last month’s Outlook build.

Why this belongs on a compliance checklist too

NIS2 Article 21 specifically calls out vulnerability handling and patch management as one of the baseline risk-management measures in-scope businesses must have in place, and GDPR Article 32 expects technical measures appropriate to the risk of the data being processed — a known, unpatched critical RCE sitting in the mail client everyone in the company uses is a hard thing to defend as “appropriate” once it’s public knowledge. Neither regulation expects every patch applied within hours, but both expect a documented, repeatable process for finding out about releases like this one and acting on them — which is a much easier conversation to have with an auditor, or an insurer after an incident, than explaining why a 9.8-rated bug sat unpatched for months.

If you manage your own Microsoft 365 tenant, checking Outlook and Exchange patch status above takes a few minutes and is worth doing this week rather than after an exploit shows up. If you’d rather have someone confirm every device actually picks up releases like this one as part of ongoing tenant management, that’s part of what our Microsoft 365 & Intune management covers, alongside the vulnerability and patch monitoring under cybersecurity & network protection.