What Happened on October 13
Microsoft released its October 2026 Patch Tuesday updates on October 13, 2026, and the size of the release broke every previous record. By BleepingComputer’s count, the updates fixed 1,411 vulnerabilities, including one actively exploited zero-day and two publicly disclosed zero-days. The total covers only flaws released on Patch Tuesday itself. Microsoft had already fixed another 348 flaws earlier in the month through separate releases for products such as Azure services and Exchange Server.
The short answer: If you run Windows, install the October 2026 security updates now. The most urgent fix is CVE-2026-96951, a Windows Shell flaw that attackers are already exploiting to bypass Mark of the Web protections. After that, prioritize internet-facing servers, domain controllers, and any system running Windows 11 version 24H2 Home or Pro, which just reached end of support.
Other outlets counted the release slightly differently, which is normal for a release this large. The Hacker News tallied 1,413 vulnerabilities, while Tenable counted 1,407. The small differences come down to which republished or third-party CVEs each outlet includes. The core picture is the same in every count: this was the largest Patch Tuesday Microsoft has ever shipped.
October 2026 Patch Tuesday at a Glance
- Release date: October 13, 2026
- Flaws fixed: 1,411 on Patch Tuesday itself, plus 348 fixed earlier in October
- Critical vulnerabilities: 70, including 57 remote code execution flaws, 11 elevation of privilege flaws, and 2 spoofing flaws
- Zero-days: 3 total, 1 actively exploited and 2 publicly disclosed
- Most urgent flaw: CVE-2026-96951, a Windows Shell security feature bypass, CVSS 8.8
- End of support: Windows 11 version 24H2 Home and Pro, and Windows 10 Enterprise LTSB 2016
The 3 Zero-Days You Need to Know About
Microsoft classifies a flaw as a zero-day when it is publicly disclosed or actively exploited before an official fix exists. October brought three of them. Only one was under active attack, but all three deserve fast attention.
1. CVE-2026-96951: Exploited Windows Shell Mark of the Web Bypass
CVE-2026-96951 is a security feature bypass in Windows Shell with a CVSS score of 8.8. Microsoft confirmed it was being exploited in the wild before the patch shipped. The flaw comes from improper handling of special characters in Windows Shell commands, which is a form of command injection.
Successful exploitation lets an attacker bypass Mark of the Web, the tag Windows applies to files downloaded from the internet. That tag is what triggers SmartScreen warnings, Office Protected View, and other safety checks. When the tag is stripped, a downloaded file can open without the warnings a user would normally see. Attackers deliver the malicious file through phishing emails, instant messages, or malicious websites, and exploitation requires the user to open it.
The US Cybersecurity and Infrastructure Security Agency added CVE-2026-96951 to its Known Exploited Vulnerabilities catalog on October 13, 2026, with a patch deadline of October 16 for federal agencies. This is the third Windows Shell flaw exploited in the wild in 2026, after CVE-2026-21510 in February and CVE-2026-32202 in April.
2. CVE-2026-108398: .NET Framework Windows Defender Application Control Bypass
CVE-2026-108398 is a security feature bypass in .NET Framework, also rated CVSS 8.8. It was publicly disclosed before a patch was available, but Microsoft reported no detected exploitation. The flaw was found by James Forshaw of Google Project Zero.
An attacker with local access could register a malicious .NET assembly to be loaded by a protected process, bypassing Windows Defender Application Control restrictions and running code inside that protected process. Microsoft rates exploitation as less likely, but the flaw matters most in environments that rely on WDAC to lock down what can run.
3. CVE-2026-92707: MessagePack-CSharp Denial of Service
CVE-2026-92707 is a denial of service vulnerability in MessagePack-CSharp, a serialization library used by .NET applications. It was publicly disclosed before a fix existed, with no confirmed exploitation. The flaw comes from improperly controlled memory allocation, which lets a remote, unauthenticated attacker crash affected applications by forcing uncontrolled memory use.
What the 1,411 Fixes Actually Cover
The raw count is so large that it helps to break it down by type. Elevation of privilege flaws made up the biggest share, followed by remote code execution and information disclosure.
- Elevation of privilege: 677 vulnerabilities
- Remote code execution: 317 vulnerabilities
- Information disclosure: 254 vulnerabilities
- Denial of service: 73 vulnerabilities
- Security feature bypass: 40 vulnerabilities
- Spoofing: 28 vulnerabilities
By product, Windows accounted for the bulk of the fixes, with 1,102 vulnerabilities according to The Hacker News count. Office accounted for 134, developer tools for 61, SharePoint Server for 36, and SQL Server for 22. Microsoft Office Excel alone accounted for 69 fixes, followed by the DNS Server role with 52 and the Windows Kernel with 46.
One critical flaw worth a separate mention is CVE-2026-70229, a remote code execution vulnerability in Windows Active Directory Domain Services rated CVSS 8.1. Microsoft assesses it as exploitation more likely, which puts it near the top of the priority list for any organization running Active Directory.
Why Is the Number So High This Month?
October did not suddenly become a worse month for Windows security. The record count mostly reflects how Microsoft is finding flaws now. Microsoft has said it increasingly uses AI tools to identify and fix vulnerabilities at scale, including a multi-model agentic scanning harness known as MDASH. In July 2026, Microsoft warned customers to expect a flood of patches as these tools came online.
The numbers tell that story. September 2026 set a then-record of nearly 1,000 fixes, roughly ten times Microsoft’s normal monthly load. October blew past that. Microsoft has now patched more than 4,000 CVEs in 2026 with two months of the year still to go, more than the 1,261 CVEs it patched in all of 2020.
That shift cuts both ways. More fixes mean more known flaws closed, but it also means a heavier testing and deployment workload for IT teams. Microsoft tried to ease that burden this month by introducing risk cohorts: 15 provisional groupings of vulnerabilities that share assessment questions, so teams can triage a whole group at once instead of judging every CVE from scratch. The largest cohort, covering Windows filesystems, storage, and backup, holds 136 vulnerabilities.
What to Patch First
Nobody patches 1,411 flaws at once. Work through this order instead.
- Internet-facing and exposed systems first. Anything reachable from the internet, plus systems that handle files from outside, should get the October updates immediately because of the exploited Windows Shell zero-day.
- Domain controllers and Active Directory. Patch CVE-2026-70229 quickly. A remote code execution flaw in AD DS with exploitation rated more likely is a direct path to full domain compromise.
- Workstations that open email attachments and downloads. The exploited zero-day spreads through crafted files, so every endpoint that handles email, chat, or web downloads needs the update.
- WDAC-protected environments. Apply the .NET Framework fix for CVE-2026-108398 so the application-control bypass is closed.
- .NET applications using MessagePack-CSharp. Apply the CVE-2026-92707 fix to stop the denial of service risk, especially for public-facing services.
- Everything else, in your normal cycle. The remaining elevation of privilege and information disclosure flaws still matter, but they generally require an attacker to already have a foothold.
If you suspect a system was already hit through the exploited zero-day, patching alone is not enough. Check for suspicious files that arrived without Mark of the Web warnings, review email and download history, and run a full malware scan. CISA guidance for exploited flaws consistently stresses that patching closes the hole but does not remove an attacker who is already inside.
How to Install the October 2026 Updates
For Home Users
On Windows 11, go to Settings, then Windows Update, and select Check for updates. On Windows 10, the path is the same. Install everything offered, then restart when prompted. If your device is enrolled in the Windows 10 Extended Security Updates program, you will keep receiving security updates through that program. If it is not, and it runs an edition that just reached end of support, this may be the last update it ever receives, which is a strong reason to upgrade.
For Businesses and IT Teams
Deploy the October cumulative updates through your normal channel, whether that is Windows Update for Business, WSUS, or Intune. Test on a pilot group first, because a release this large carries a real chance of a compatibility surprise. Key updates reported for this release include KB5127648 for Windows 11 versions 26H2, 25H2, and 24H2, KB5127646 for Windows 11 version 26H1, KB5126657 for Windows 10 versions 21H2 and 22H2, KB5126646 for Windows Server 2025, and KB5126655 for Windows Server 2022. Separate updates were also provided for SQL Server and Exchange Server.
Use the risk cohort groupings to speed up triage, and track the CISA KEV deadline of October 16 for CVE-2026-96951 as your hard floor for the exploited flaw, even if your organization is not a federal agency.
End of Support: Windows 11 24H2 Home and Pro
October 13, 2026 also marked the end of support for Windows 11 version 24H2 Home and Pro, and for Windows 10 Enterprise LTSB 2016. Microsoft said the October 2026 monthly security update is the last update available for these editions. Devices on those editions will no longer receive security fixes, which means every future vulnerability stays open.
Microsoft also warned that organizations running Windows 11 version 23H2 Enterprise, Education, and IoT Enterprise editions should upgrade soon, because those editions stop receiving security updates next month. If you are still on 24H2 Home or Pro, check your version under Settings, then System, then About, and plan the upgrade now. The same advice applies to anyone still running an unsupported Windows 10 edition without Extended Security Updates.
End-of-support deadlines like this one are easy to ignore and expensive to miss. An unpatched operating system is one of the simplest ways for an attacker to get in, and it also tends to void the security assumptions behind everything else on the device.
How This Fits the Bigger Picture
October 2026 has been a heavy month for security teams well beyond Microsoft. The same week brought a newly exploited Ivanti Connect Secure zero-day that CISA added to its KEV catalog, a Citrix NetScaler SAML zero-day with targeted exploitation, and a critical SonicWall SSRF flaw. You can read our breakdowns of the Citrix NetScaler SAML zero-day, the SonicWall SMA 1000 SSRF flaw, and the Apple zero-day for the details on each one.
Microsoft’s record Patch Tuesday is best understood in that context. AI-assisted discovery is surfacing flaws faster than before, and attackers are exploiting the most useful ones faster than before. The practical response is not to read all 1,411 advisories. It is to patch the exploited flaw today, patch the likely-to-be-exploited flaws this week, keep the normal cycle moving for the rest, and get off any edition that just lost support.
Frequently Asked Questions
Do I need to install all 1,411 fixes?
Yes, in practice. Windows updates are cumulative, so installing the October 2026 cumulative update applies the fixes for your edition in one package. You do not pick individual CVEs. The priority list in this article is about the order in which you roll the update out, not about skipping fixes.
What is the most dangerous flaw in the October 2026 Patch Tuesday?
CVE-2026-96951, the Windows Shell Mark of the Web bypass, because it is already being exploited in the wild. It lets a malicious file open without the warnings Windows normally shows for downloads. Patch it immediately and treat any unexpected downloaded file with extra caution until the update is installed.
What is Mark of the Web?
Mark of the Web is a tag Windows applies to files that come from the internet. It tells Windows and Office to treat the file with suspicion, which triggers SmartScreen warnings, Office Protected View, and macro blocking. Bypassing it removes several layers of protection at once, which is why this zero-day matters more than its CVSS score alone suggests.
Why do different sites report 1,407, 1,411, or 1,413 flaws?
They count slightly different sets. BleepingComputer counts only flaws released on Patch Tuesday itself, which gives 1,411 and excludes 348 flaws fixed earlier in October. Other outlets include republished or third-party CVEs, which pushes the total a little higher or lower. The difference does not change what you need to do.
Is Windows 11 version 24H2 still safe to use?
Not after October 13, 2026. Microsoft ended support for Windows 11 version 24H2 Home and Pro on that date, and the October update was the last one for those editions. Without future security updates, new vulnerabilities will stay unpatched. Upgrade to a supported version as soon as you can.
What should IT teams do if they cannot patch immediately?
Reduce exposure first. Warn users not to open unexpected attachments or downloads, tighten email filtering, and consider blocking risky file types at the gateway. For the WDAC bypass, monitor for suspicious .NET assembly loading. These are stopgaps, not substitutes. The patch is the fix, so schedule it as soon as testing allows.