Microsoft October 2026 Patch Tuesday Fixes 1,411 Flaws, Including Three Zero-Days, One Actively Exploited

Microsoft's October 2026 Patch Tuesday fixes a record 1,411 flaws, according to BleepingComputer. The count covers only fixes released on Patch Tuesday itself and excludes 348 flaws Microsoft fixed earlier in the month, in products including Azure App Service, Exchange Server, Microsoft Bookings and Microsoft Dataverse.

70 Critical flaws. BleepingComputer reports that 70 of the fixes are rated Critical: 57 remote code execution bugs, 11 elevation of privilege and 2 spoofing. Across the whole release, elevation of privilege leads with 677 flaws, followed by 317 remote code execution and 254 information disclosure bugs (approximate, per BleepingComputer). BleepingComputer calls it a record-breaking Patch Tuesday and links the total to Microsoft's use of AI platforms to find and fix vulnerabilities.

Three zero-days, one under attack. CVE-2026-96951 is the only flaw exploited in the wild. Microsoft calls it a Windows Shell Security Feature Bypass, rated Important with a CVSS score of 8.8, and says improper neutralization of special elements in a command lets "an unauthorized attacker" to "bypass a security feature over a network." BleepingComputer describes it as a Mark of the Web bypass. Mark of the Web is a tag Windows adds to files downloaded from the internet, used to apply extra security checks. Microsoft has not said how attackers used it or who reported it.

Two more were public before the fix. CVE-2026-108398 is a .NET Framework security feature bypass that Microsoft says could let an authenticated attacker evade Windows Defender Application Control and run code inside a protected process. BleepingComputer credits James Forshaw of Google Project Zero with finding it. CVE-2026-92707 is a denial-of-service flaw in MessagePack-CSharp.

CISA sets a three-day deadline. CISA added CVE-2026-96951 to its Known Exploited Vulnerabilities catalog on October 13, listing it as a Microsoft Windows command injection vulnerability. Federal civilian agencies must patch by October 16. CISA lists ransomware use as unknown.

Last update for some Windows editions. Microsoft says Windows 11 version 24H2 Home and Pro and Windows 10 Enterprise LTSB 2016 reached end of updates on October 13, making this month's release their final security update. Windows 11 23H2 Enterprise, Education and IoT Enterprise stop getting security updates next month, Microsoft has said.

What it means for you. Install October's updates now, starting with Windows machines, since CVE-2026-96951 is already being exploited. Windows users get October's fixes through Windows Update. This month's releases include the Windows 11 cumulative updates KB5127648 and KB5126653 and the Windows 10 extended security update KB5126657, according to BleepingComputer. Anyone still on Windows 11 24H2 Home or Pro should plan an upgrade, because no more security fixes are coming.