October brought Microsoft’s largest ever Patch Tuesday: over 1,400 fixes, around 70 rated critical, and three zero-days.
The one to act on is CVE-2026-96951, which is already being exploited. It bypasses the “Mark of the Web” warning that normally appears on files downloaded from the internet or received by email. There is also a critical Active Directory remote code execution flaw (CVE-2026-70229).
Why it matters
Mark of the Web is one of the last safety nets between a member of staff and a malicious attachment. With it bypassed, the file simply opens.
Patch in the right order
- Domain controllers first, then staff laptops and office PCs.
- Use update rings rather than pushing to everything at once.
- Check coverage for devices that missed their policy or haven’t been online for weeks.
- Remind staff that attachment warnings can’t be relied on this month.
The catch: Exchange mail flow
The same October updates can break on-premises Exchange running on Windows Server 2019 and later. Staff may be unable to sign in to Outlook or Outlook on the web, and sent email can sit in the Outbox without being delivered. Look for MapiExceptionMdbOffline (ec=1142) and Event ID 1006. The cause is a new memory limit that is too low for a busy Exchange server.
Because it depends on load, it can appear days after patching, at the busiest point of the morning, and it fails quietly: staff believe their email has gone when it hasn’t.
- Don’t uninstall the updates. Microsoft is explicit about this.
- Apply Microsoft’s workaround on the Exchange server and reboot. Check Microsoft’s release health dashboard first in case the guidance has moved on.
- Check the logs for Event ID 1006 and ask staff whether anything is stuck in their Outbox.
If your school still runs Exchange on-premises, it’s worth asking whether it should. Moving mail to Exchange Online removes this whole category of problem, and is often already included in your Microsoft 365 education licensing.
How we can help
This story first appeared in School IT Intelligence Week 8, our free weekly briefing for school IT teams and leaders. Read the full issue or subscribe free to get it every week.
Not sure where your school stands? Give us one day in your school and we’ll review your systems, licensing and security, and show you where money is being wasted and where risk is hiding. Book your IT review day →