Microsoft's October 2026 Patch Tuesday, released on October 13, is a record monthly security release according to both BleepingComputer and SecurityWeek. BleepingComputer counts 1,411 vulnerabilities fixed and SecurityWeek counts 1,413. Only one of them is known to be under active attack: CVE-2026-96951, a security feature bypass in Windows Shell that gets around Mark of the Web (MotW), the label Windows attaches to files that come from the internet. The Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on the day of release.
Two more vulnerabilities were publicly disclosed before patches were available: a .NET Framework flaw that can bypass Windows Defender Application Control (WDAC), and a denial-of-service bug in MessagePack-CSharp. The release also introduces an experimental way to prioritize patches, called "risk cohorts." And for some Windows editions, including Windows 11 version 24H2 Home and Pro, it is the last update.
Why the totals differ
The two outlets publish slightly different totals. BleepingComputer says its 1,411 leaves out 348 flaws Microsoft fixed earlier in the month, including flaws in Azure services, Microsoft Exchange Server, Microsoft Dataverse and Microsoft Bookings. SecurityWeek reports 1,413 and does not say why its figure differs. Both outlets call the month a record.
BleepingComputer rates 70 of the fixes Critical: 57 remote code execution (RCE) flaws, 11 elevation of privilege (EoP) flaws and 2 spoofing flaws. It gives this breakdown by type for the whole release and describes the figures as approximate. They add up to 1,389, short of the headline total:
- 677 elevation of privilege
- 317 remote code execution
- 254 information disclosure
- 73 denial of service
- 40 security feature bypass
- 28 spoofing
SecurityWeek breaks the total down by product: 1,102 in Windows, 134 in Office, 61 in developer tools and 36 in SharePoint Server, plus patches for Exchange Server, Azure, Defender and other products. By its count, October alone fixed more vulnerabilities than Microsoft patched in all of 2025, and the 2026 total is now above 4,000. SecurityWeek describes the increase as "largely driven by AI."
The exploited flaw: CVE-2026-96951
Microsoft classifies CVE-2026-96951 as a Windows Shell security feature bypass. The description Microsoft supplied to NVD reads: "Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network." NVD lists the weakness as CWE-77, and CISA's KEV entry names it the "Microsoft Windows Command Injection Vulnerability." BleepingComputer reports that the flaw allowed attackers to bypass the Mark of the Web security feature.
MotW is the tag Windows adds to files that arrive from the internet so that protections meant for untrusted files can be applied. If MotW is bypassed, a file from an untrusted source can be handled as if those protections did not apply.
The CVSS 3.1 score is 8.8 (High), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. User interaction is required. SecurityWeek reports that an attacker could deliver a crafted file by email or instant message but would have to convince the user to take action. NVD's affected-product list includes supported Windows 10 and Windows 11 releases, several Windows Server versions going back to Windows Server 2012 R2, and Outlook on the web. SecurityWeek credits the report to Fujitsu, Anthropic and an independent researcher. None of the sources describe who is exploiting the flaw or how widely it is being used.
CISA added CVE-2026-96951 to KEV on October 13, in the same alert that added CVE-2026-104935, an authentication bypass by spoofing in Ivanti Connect Secure. CISA's KEV catalog sets a due date of October 16, 2026 for the Windows flaw, three days after it was listed; that deadline has passed. The required action tells agencies to apply mitigations according to vendor instructions and to comply with CISA's BOD 26-04, "Prioritizing Security Updates Based on Risk," and its forensics triage requirements.
Two flaws disclosed before the fix
CVE-2026-108398 is a .NET Framework security feature bypass. Microsoft describes it as an "untrusted search path in .NET Framework" that "allows an authorized attacker to bypass a security feature locally." BleepingComputer reports that it could let attackers bypass Windows Defender Application Control and run unauthorized applications, and that user interaction is not required. BleepingComputer credits the discovery to James Forshaw of Google Project Zero. WDAC controls which code can run on locked-down systems, so this flaw matters most to organizations that depend on application allowlisting. SecurityWeek reports that Microsoft considers exploitation unlikely.
CVE-2026-92707 is a denial-of-service vulnerability that SecurityWeek places in the MessagePack-CSharp component of Visual Studio and .NET. Microsoft describes it as "improperly controlled sequential memory allocation in .NET" that "allows an unauthorized attacker to deny service over a network." The details were public before a fix existed. According to SecurityWeek, Microsoft has not assessed how likely it is to be exploited, and Microsoft has not said who disclosed it.
Risk cohorts
Microsoft is also trying a new way to help administrators rank a release this large. BleepingComputer reports that Microsoft published 15 "risk cohorts," which group related CVEs. The largest include 136 vulnerabilities in Windows filesystems, storage and backup, 135 in Office documents and mail clients, and 131 in Windows graphics, media and content processing. Microsoft says a risk cohort "is a group of CVEs that require a similar customer assessment." As quoted by SecurityWeek, the company adds, "Risk cohorts are a starting point, not a final decision," and says customers should keep reviewing each CVE for active exploitation, severity, attack vector, user interaction and product-specific guidance. BleepingComputer notes that the cohorts do not indicate which flaws are most dangerous and that the approach is experimental.
End of updates for some Windows editions
BleepingComputer reports that Windows 11 version 24H2 Home and Pro, and Windows 10 Enterprise LTSB 2016, have reached end of updates. It quotes Microsoft: "The October 2026 monthly security update is the last update available for these editions." Machines still running those editions will not receive future fixes. BleepingComputer adds that Windows 11 23H2 Enterprise, Education and IoT Enterprise will stop receiving security updates next month. This month BleepingComputer also lists the Windows 11 cumulative updates KB5127648 and KB5126653 and the Windows 10 extended security update KB5126657.
What It Means for Defenders
- Patch for CVE-2026-96951 first. It is the only flaw in this release confirmed as exploited, and it is in CISA's KEV catalog with a federal due date of October 16, 2026, which has passed. Check that the October 2026 security updates are installed on every endpoint and server. NVD lists the fixed builds, for example 10.0.26100.9711 for Windows 11 version 24H2 and 10.0.26200.9711 for version 25H2.
- Do not rely on MotW alone until you have patched. Exploitation requires a user to act on a crafted file sent by email or message. Filtering risky attachment types at the email and web gateways adds a layer of protection, and reminding users about unexpected attachments helps too. Neither replaces the update.
- Check application-control deployments. If you rely on WDAC, install the .NET Framework updates that fix CVE-2026-108398, even though Microsoft considers exploitation unlikely. A bypass of an allowlisting control weakens a defense that other protections assume is working.
- Update Visual Studio and .NET components for CVE-2026-92707. The details were public before the fix, so make sure development environments and .NET components that include MessagePack-CSharp are updated.
- Find unsupported Windows editions. Locate any remaining Windows 11 24H2 Home/Pro and Windows 10 Enterprise LTSB 2016 machines. They will receive no further fixes, so plan upgrades or isolate them. Plan now for Windows 11 23H2 Enterprise, Education and IoT Enterprise as well.
- Use risk cohorts carefully. They can help organize testing and rollout across a very large release, but Microsoft itself calls them a starting point. Exploitation status and KEV listings should still decide what gets patched first.
- Watch the Ivanti entry in the same KEV alert. If you run Ivanti Connect Secure, CVE-2026-104935 was added to KEV in the same alert. According to CISA, it allows a remote unauthenticated attacker to execute arbitrary commands, so it needs its own response.
