Security Digest: October 17, 2026 - 5 Critical Vulnerabilities

Microsoft released fixes for five high-severity vulnerabilities affecting Windows and identity infrastructure. Two issues can knock Active Directory Federation Services (AD FS) offline, while the others can expose information or let a local attacker gain higher privileges.

· 29 min read

Windows flaws demand immediate patching: RRAS info leak, AD FS denial of service, and two local privilege escalations

Executive Summary

Microsoft released fixes for five high-severity vulnerabilities affecting Windows and identity infrastructure. Two issues can knock Active Directory Federation Services (AD FS) offline, while the others can expose information or let a local attacker gain higher privileges.

Patch Windows endpoints and identity servers now. Prioritize internet-facing systems, domain-connected servers, and any workstation used by privileged staff. If you cannot patch immediately, isolate exposed services and increase monitoring for abuse.

Critical Vulnerabilities

CVE-2026-85322: RRAS information disclosure over the network

  • Impact: An unauthenticated network attacker can disclose information from Windows Routing and Remote Access Service (RRAS). That can help attackers map your environment and prepare follow-on attacks.
  • Affected Systems: Windows 10 1607, Windows 10 1809, Windows 10 21H2, Windows 10 22H2, Windows 11 23H2
  • Immediate Action: Patch affected Windows systems as soon as possible, especially any host running RRAS or exposed to untrusted networks.
  • Mitigation: Apply the Microsoft security update for this issue. If patching is delayed, restrict RRAS exposure to trusted networks only and review access controls.

CVE-2026-85319: AD FS resource exhaustion leading to denial of service

  • Impact: A remote attacker can trigger uncontrolled resource consumption and make AD FS unavailable, disrupting sign-in and federation services.
  • Affected Systems: AD FS deployments running Microsoft Windows Server environments with the vulnerable component enabled.
  • Immediate Action: Treat this as a service-availability incident. Patch AD FS servers first, starting with production identity endpoints and any externally reachable federation service.
  • Mitigation: Install the vendor update. Until then, place rate limits and upstream filtering in front of AD FS where possible and watch for abnormal request spikes.

CVE-2026-85321: AD FS resource exhaustion leading to denial of service

  • Impact: Another AD FS flaw allows remote attackers to consume resources without limits, causing service degradation or outage.
  • Affected Systems: AD FS deployments on supported Microsoft server platforms.
  • Immediate Action: Patch immediately alongside CVE-2026-85319. If you run redundant AD FS nodes, update them in a controlled sequence to avoid a full outage.
  • Mitigation: Apply Microsoft’s fix. Use temporary traffic controls and monitor for repeated authentication requests or unusual load on federation servers.

CVE-2026-85329: Microsoft Account race condition enables local privilege escalation

  • Impact: An authorized local attacker can exploit a race condition to elevate privileges on the affected device.
  • Affected Systems: Windows 10 1607, Windows 10 1809, Windows 10 21H2, Windows 10 22H2, Windows 11 23H2
  • Immediate Action: Patch all affected endpoints, especially shared workstations and systems used by admins, developers, and support staff.
  • Mitigation: Install the security update. Reduce local admin exposure and review which users can log on interactively to sensitive systems.

CVE-2026-85328: Windows Projected File System weak authentication enables local privilege escalation

  • Impact: An authorized attacker with local access can gain elevated privileges through weak authentication in Windows Projected File System.
  • Affected Systems: Windows 10 1809, Windows 10 21H2, Windows 10 22H2, Windows 11 23H2, Windows 11 24H2
  • Immediate Action: Prioritize patching on laptops, developer machines, and any endpoint where privileged users sign in.
  • Mitigation: Apply Microsoft’s update. Until patched, limit untrusted local access and monitor for suspicious privilege changes or new admin-level processes.

Previously Alerted

What to Do Now

  1. Patch first: Deploy Microsoft’s latest security updates to all affected Windows endpoints and AD FS servers today, starting with internet-facing systems.
  2. Protect identity services: If AD FS is exposed externally, add rate limiting, confirm failover is working, and validate authentication flows after patching.
  3. Reduce exposure: Limit RRAS access to trusted networks and ensure only necessary users can reach affected hosts.
  4. Harden local access: Review who has local logon rights on affected endpoints and remove unnecessary admin privileges.
  5. Verify: Confirm patch installation across all targeted builds and check for any failed updates or reboot-pending systems.
  6. Monitor: Watch for spikes in AD FS traffic, RRAS anomalies, unexpected privilege changes, and unusual local process creation on Windows endpoints.

Verification steps:

  • Check device compliance reports for the listed Windows versions.
  • Confirm AD FS service health after maintenance windows.
  • Review endpoint security logs for new admin group membership, suspicious token use, or repeated authentication failures.

Monitoring recommendations: Alert on abnormal federation request volume, repeated network access to RRAS, privilege escalation indicators, and any sign that patched systems remain vulnerable due to missed reboots or failed deployments.

Related Resources

  • Internal blog post: Windows October 2026 patch response guide (to be published).
  • Internal blog post: How to prioritize AD FS and RRAS emergency updates (to be published).
  • Official vendor advisories: Microsoft Security Update Guide and the corresponding October 2026 Patch Tuesday advisories.

Keep reading