Microsoft October 2026 Patch Tuesday fixes 1,411 flaws and 3 zero-days

Microsoft released its October 2026 Patch Tuesday security updates on October 13, 2026, addressing a record-breaking 1,411 flaws. The update includes one actively exploited zero-day vulnerability and two publicly disclosed zero-day vulnerabilities.

Vulnerability Breakdown

The October 2026 release addresses 70 "Critical" vulnerabilities. Of these, 57 are remote code execution flaws, 11 are elevation of privilege flaws, and 2 are spoofing flaws. The total count of 1,411 excludes 348 flaws fixed earlier in the month in products such as Azure API Center, Azure App Service, and Microsoft Exchange Server.

The vulnerabilities are categorized as follows:

• 677 Elevation of Privilege Vulnerabilities
• 40 Security Feature Bypass Vulnerabilities
• 317 Remote Code Execution Vulnerabilities
• 254 Information Disclosure Vulnerabilities
• 73 Denial of Service Vulnerabilities
• 28 Spoofing Vulnerabilities

Zero-Day Vulnerabilities

Microsoft patched three zero-day vulnerabilities in this release. One is actively exploited, and two are publicly disclosed.

CVE-2026-96951 (Actively Exploited) This Windows Shell Security Feature Bypass Vulnerability allows attackers to bypass the Mark of the Web security feature. "Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network," warns Microsoft. No details have been shared regarding how attackers exploited the flaw or who disclosed it.

CVE-2026-108398 (Publicly Disclosed) This .NET Framework Security Feature Bypass Vulnerability can be exploited to run unauthorized applications. "Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally," explains Microsoft. The company says this flaw could allow attackers to bypass Windows Defender Application Control (WDAC) enforcement. "An authenticated attacker could place a specially crafted .NET assembly on an affected system and register it for loading by a protected process," Microsoft says. James Forshaw of Google Project Zero discovered the flaw.

CVE-2026-92707 (Publicly Disclosed) This MessagePack-CSharp Denial of Service Vulnerability involves improperly controlled sequential memory allocation. "Improperly controlled sequential memory allocation in .NET allows an unauthorized attacker to deny service over a network," explains Microsoft. Microsoft has not shared who disclosed this vulnerability.

Windows Support Changes

Microsoft announced that Windows 11, version 24H2 Home and Pro, and Windows 10 Enterprise LTSB 2016 have reached end of support. "Today, October 13, 2026, Windows 11, version 24H2 Home and Pro, and Windows 10 Enterprise LTSB 2016 have reached end of updates. The October 2026 monthly security update is the last update available for these editions," Microsoft said.

Additionally, organizations running Windows 11 23H2 Enterprise, Education, and IoT Enterprise editions will no longer receive security updates starting next month.

New Risk Cohorts

Microsoft introduced a new method for organizations to prioritize security updates by grouping related flaws into "risk cohorts." For October 2026, Microsoft published 15 risk cohorts. Examples include:

• 136 vulnerabilities affecting Windows filesystems, storage, and backup.
• 135 vulnerabilities involving Office documents and mail clients.
• 131 vulnerabilities affecting Windows graphics, media, and content processing.

Microsoft states that these groups do not necessarily indicate which flaws are the most dangerous, as actual risk depends on exploitation status, severity, and organizational usage. The company says the new approach is still experimental and is meant to help organizations prioritize security updates, not replace its existing patching recommendations.

Why it matters

This release marks a record number of vulnerabilities addressed in a single Patch Tuesday. The presence of an actively exploited zero-day in Windows Shell highlights the ongoing threat of security feature bypasses. Organizations must also manage the transition for Windows editions reaching end of support to ensure continued protection.

---

Sources

• bleepingcomputer.com: Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days
• linkedin.com: Microsoft’s Record October Patch Tuesday Fixes 1,400+ Flaws As Windows Zero-Day Comes Under Attack

This article was drafted with AI assistance and checked against the sources above. Company claims are reported as claims. Cover image is AI-generated.