In the patch Tuesday for October, Microsoft released fixes for 71 vulnerabilities, one of which was actively exploited and found in Win32k.
While the fixed zero-day bugs CVE-2021-40449, CVE-2021-41338, CVE-2021-40469, and CVE-2021-41335 are being tracked, CVE-2021-40449 with a CVSS severity of 7.8 is actively exploited.
Three other zero-day bugs include CVE-2021-41338, a bug in the Windows AppContainer Firewall with a CVSS severity of 5.5 that allows attackers to bypass security features, CVE-2021-40469, an RCE in the Windows DNS Server with a CVSS severity of 7.2, and finally CVE-2021-41335, an elevated privilege bug with a CVSS severity of 7.8 found in the Windows Kernel.
Other bugs that have been fixed are three critical bugs, CVE-2021-40486, CVE-2021-38672, and CVE-2021-40461. While the first flaw impacts Microsoft Word, the other two flaws affect Hyper-V.
However, in cases where they are exploited, they can all lead to remote code execution.