CSIRT Panamá Aviso 2026-Oct-13 Actualizaciones de seguridad de Microsoft para Octubre 2026.
Gravedad: Alta
Fecha de publicación: octubre 13, 2026
Última revisión: octubre 13, 2026
https://msrc.microsoft.com/update-guide/releaseNote/2026-Oct
Sistemas Afectados:
Active Directory Federation Services (AD FS)
Azure API Center
Azure App Service
Azure Event Grid
Azure SRE Agent
HEVC Video Extensions
Linux Kernel
Microsoft Bookings
Microsoft Dataverse
Microsoft Excel
Microsoft Exchange Server
Microsoft Graphics Component
Microsoft Office Excel
Microsoft Office Outlook
Microsoft Office PowerPoint
Microsoft Office SharePoint
Microsoft Office Visio
Microsoft Office Word
Microsoft Partner Center
Microsoft PostScript Printer Driver
Microsoft QUIC
Microsoft Windows Media Foundation
Microsoft Windows PDF
Network Device Enrollment Service (NDES)
Windows Active Directory Domain Services
Windows ALPC
Windows Deployment Services
Windows DHCP Client
Windows DHCP Server
Windows GDI+
Windows Graphics Kernel
Windows Hyper-V
Windows Kernel
Windows Media Video Decoder
Windows Message Queuing
Windows Message Queuing Queue Manager
Windows Raw Image Extension
Windows Reliable Multicast Transport Driver (RMCAST)
Windows Remote Desktop Services
Windows Shell
Windows Text Shaping
Windows Virtualization-Based Security (VBS) Enclave
I. Descripción
Microsoft ha liberado sus actualizaciones de seguridad correspondientes al mes de octubre de 2026.
Este conjunto de actualizaciones remedia 1417 fallas y 3 días cero (1 explotado activamente y 2 divulgados públicamente).
Vulnerabilidades explotadas activamente: CVE-2026-96951 (Windows Shell Security Feature Bypass Vulnerability).
Vulnerabilidades divulgadas públicamente: CVE-2026-108398 (.NET Framework Security Feature Bypass Vulnerability) y CVE-2026-92707 (MessagePack-CSharp Denial of Service Vulnerability).
II. Detalle
En este aviso se incluyen solo las vulnerabilidades más relevantes: las de severidad crítica y las explotadas activamente (77 de 1417). Para ver el resto de las vulnerabilidades corregidas, consulte el sitio de Microsoft: https://msrc.microsoft.com/update-guide/releaseNote/2026-Oct
| Tag | CVE ID | CVE Title | Severity |
|---|---|---|---|
| Active Directory Federation Services (AD FS) | CVE-2026-108131 | Active Directory Federation Services (AD FS) Spoofing Vulnerability | Critical |
| Active Directory Federation Services (AD FS) | CVE-2026-96222 | Active Directory Federation Services (AD FS) Spoofing Vulnerability | Critical |
| Azure API Center | CVE-2026-83943 | Azure API Center Information Disclosure Vulnerability | Critical |
| Azure App Service | CVE-2026-77900 | Azure App Service Remote Code Execution Vulnerability | Critical |
| Azure Event Grid | CVE-2026-83947 | Azure Event Grid Spoofing Vulnerability | Critical |
| Azure SRE Agent | CVE-2026-69435 | Azure SRE Agent Elevation of Privilege Vulnerability | Critical |
| HEVC Video Extensions | CVE-2026-108400 | HEVC Video Extensions Remote Code Execution Vulnerability | Critical |
| Linux Kernel | CVE-2026-62840 | Linux Kernel Elevation of Privilege Vulnerability | Critical |
| Microsoft Bookings | CVE-2026-94510 | Microsoft Bookings Elevation of Privilege Vulnerability | Critical |
| Microsoft Dataverse | CVE-2026-88131 | Microsoft Dataverse Remote Code Execution Vulnerability | Critical |
| Microsoft Excel | CVE-2026-105718 | Microsoft Excel Remote Code Execution Vulnerability | Critical |
| Microsoft Exchange Server | CVE-2026-70571 | Microsoft Exchange Server Remote Code Execution Vulnerability | Critical |
| Microsoft Graphics Component | CVE-2026-100215 | Microsoft Graphics Component Remote Code Execution Vulnerability | Critical |
| Microsoft Office Excel | CVE-2026-100209 | Microsoft Office Excel Remote Code Execution Vulnerability | Critical |
| Microsoft Office Excel | CVE-2026-100210 | Microsoft Office Excel Remote Code Execution Vulnerability | Critical |
| Microsoft Office Excel | CVE-2026-100211 | Microsoft Office Excel Remote Code Execution Vulnerability | Critical |
| Microsoft Office Excel | CVE-2026-97739 | Microsoft Office Excel Remote Code Execution Vulnerability | Critical |
| Microsoft Office Excel | CVE-2026-97745 | Microsoft Office Excel Remote Code Execution Vulnerability | Critical |
| Microsoft Office Excel | CVE-2026-97755 | Microsoft Office Excel Remote Code Execution Vulnerability | Critical |
| Microsoft Office Excel | CVE-2026-97759 | Microsoft Office Excel Remote Code Execution Vulnerability | Critical |
| Microsoft Office Excel | CVE-2026-97765 | Microsoft Office Excel Remote Code Execution Vulnerability | Critical |
| Microsoft Office Excel | CVE-2026-97778 | Microsoft Office Excel Remote Code Execution Vulnerability | Critical |
| Microsoft Office Excel | CVE-2026-97780 | Microsoft Office Excel Remote Code Execution Vulnerability | Critical |
| Microsoft Office Outlook | CVE-2026-70242 | Microsoft Office Outlook Remote Code Execution Vulnerability | Critical |
| Microsoft Office Outlook | CVE-2026-70291 | Microsoft Office Outlook Remote Code Execution Vulnerability | Critical |
| Microsoft Office Outlook | CVE-2026-88156 | Microsoft Office Outlook Remote Code Execution Vulnerability | Critical |
| Microsoft Office Outlook | CVE-2026-97016 | Microsoft Office Outlook Remote Code Execution Vulnerability | Critical |
| Microsoft Office Outlook | CVE-2026-97749 | Microsoft Office Outlook Remote Code Execution Vulnerability | Critical |
| Microsoft Office PowerPoint | CVE-2026-70215 | Microsoft Office PowerPoint Remote Code Execution Vulnerability | Critical |
| Microsoft Office PowerPoint | CVE-2026-88144 | Microsoft Office PowerPoint Remote Code Execution Vulnerability | Critical |
| Microsoft Office PowerPoint | CVE-2026-88178 | Microsoft Office PowerPoint Remote Code Execution Vulnerability | Critical |
| Microsoft Office PowerPoint | CVE-2026-88207 | Microsoft Office PowerPoint Remote Code Execution Vulnerability | Critical |
| Microsoft Office SharePoint | CVE-2026-102866 | Microsoft Office SharePoint Elevation of Privilege Vulnerability | Critical |
| Microsoft Office Visio | CVE-2026-102855 | Microsoft Office Visio Remote Code Execution Vulnerability | Critical |
| Microsoft Office Visio | CVE-2026-102856 | Microsoft Office Visio Remote Code Execution Vulnerability | Critical |
| Microsoft Office Visio | CVE-2026-102857 | Microsoft Office Visio Remote Code Execution Vulnerability | Critical |
| Microsoft Office Word | CVE-2026-70269 | Microsoft Office Word Remote Code Execution Vulnerability | Critical |
| Microsoft Office Word | CVE-2026-88185 | Microsoft Office Word Remote Code Execution Vulnerability | Critical |
| Microsoft Partner Center | CVE-2026-96207 | Microsoft Partner Center Elevation of Privilege Vulnerability | Critical |
| Microsoft PostScript Printer Driver | CVE-2026-108467 | Microsoft PostScript Printer Driver Remote Code Execution Vulnerability | Critical |
| Microsoft PostScript Printer Driver | CVE-2026-70147 | Microsoft PostScript Printer Driver Remote Code Execution Vulnerability | Critical |
| Microsoft PostScript Printer Driver | CVE-2026-70153 | Microsoft PostScript Printer Driver Remote Code Execution Vulnerability | Critical |
| Microsoft QUIC | CVE-2026-100219 | Microsoft QUIC Remote Code Execution Vulnerability | Critical |
| Microsoft QUIC | CVE-2026-105016 | Microsoft QUIC Remote Code Execution Vulnerability | Critical |
| Microsoft Windows Media Foundation | CVE-2026-96952 | Microsoft Windows Media Foundation Remote Code Execution Vulnerability | Critical |
| Microsoft Windows PDF | CVE-2026-108457 | Microsoft Windows PDF Remote Code Execution Vulnerability | Critical |
| Network Device Enrollment Service (NDES) | CVE-2026-69802 | Network Device Enrollment Service (NDES) Remote Code Execution Vulnerability | Critical |
| Windows Active Directory Domain Services | CVE-2026-70229 | Windows Active Directory Domain Services Remote Code Execution Vulnerability | Critical |
| Windows ALPC | CVE-2026-83917 | Windows ALPC Elevation of Privilege Vulnerability | Critical |
| Windows Deployment Services | CVE-2026-88174 | Windows Deployment Services Remote Code Execution Vulnerability | Critical |
| Windows DHCP Client | CVE-2026-70250 | Windows DHCP Client Remote Code Execution Vulnerability | Critical |
| Windows DHCP Server | CVE-2026-88117 | Windows DHCP Server Remote Code Execution Vulnerability | Critical |
| Windows DHCP Server | CVE-2026-88119 | Windows DHCP Server Remote Code Execution Vulnerability | Critical |
| Windows DHCP Server | CVE-2026-88120 | Windows DHCP Server Remote Code Execution Vulnerability | Critical |
| Windows DHCP Server | CVE-2026-88171 | Windows DHCP Server Remote Code Execution Vulnerability | Critical |
| Windows DHCP Server | CVE-2026-96934 | Windows DHCP Server Remote Code Execution Vulnerability | Critical |
| Windows GDI+ | CVE-2026-83934 | Windows GDI+ Remote Code Execution Vulnerability | Critical |
| Windows Graphics Kernel | CVE-2026-88073 | Windows Graphics Kernel Elevation of Privilege Vulnerability | Critical |
| Windows Hyper-V | CVE-2026-102214 | Windows Hyper-V Remote Code Execution Vulnerability | Critical |
| Windows Hyper-V | CVE-2026-105733 | Windows Hyper-V Remote Code Execution Vulnerability | Critical |
| Windows Hyper-V | CVE-2026-108399 | Windows Hyper-V Elevation of Privilege Vulnerability | Critical |
| Windows Kernel | CVE-2026-96913 | Windows Kernel Elevation of Privilege Vulnerability | Critical |
| Windows Media Video Decoder | CVE-2026-100220 | Windows Media Video Decoder Remote Code Execution Vulnerability | Critical |
| Windows Message Queuing | CVE-2026-108460 | Windows Message Queuing Remote Code Execution Vulnerability | Critical |
| Windows Message Queuing Queue Manager | CVE-2026-100202 | Windows Message Queuing Queue Manager Remote Code Execution Vulnerability | Critical |
| Windows Raw Image Extension | CVE-2026-96202 | Windows Raw Image Extension Remote Code Execution Vulnerability | Critical |
| Windows Raw Image Extension | CVE-2026-96943 | Windows Raw Image Extension Remote Code Execution Vulnerability | Critical |
| Windows Reliable Multicast Transport Driver (RMCAST) | CVE-2026-69789 | Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability | Critical |
| Windows Remote Desktop Services | CVE-2026-70187 | Windows Remote Desktop Services Remote Code Execution Vulnerability | Critical |
| Windows Shell | CVE-2026-96951 | Windows Shell Security Feature Bypass Vulnerability | Important |
| Windows Text Shaping | CVE-2026-102225 | Windows Text Shaping Remote Code Execution Vulnerability | Critical |
| Windows Text Shaping | CVE-2026-97814 | Windows Text Shaping Remote Code Execution Vulnerability | Critical |
| Windows Virtualization-Based Security (VBS) Enclave | CVE-2026-102211 | Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability | Critical |
| Windows Virtualization-Based Security (VBS) Enclave | CVE-2026-108130 | Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability | Critical |
| Windows Virtualization-Based Security (VBS) Enclave | CVE-2026-108471 | Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability | Critical |
| Windows Virtualization-Based Security (VBS) Enclave | CVE-2026-88074 | Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability | Critical |
| Windows Virtualization-Based Security (VBS) Enclave | CVE-2026-96914 | Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability | Critical |
III. Referencia a soluciones, herramientas e información
Actualizar utilizando Microsoft Windows Update o herramientas de administración de actualizaciones centralizadas.
IV. Información de contacto
CSIRT PANAMA
Computer Security Incident Response Team Autoridad Nacional para la Innovacion Gubernamental
E-Mail: incidentes@cert.pa
E-Mail: info@cert.pa
Phone: +507 520-CERT (2378)
Web: https://cert.pa
Key ID: 16F2B124