Microsoft's Record October Patch Tuesday: 1,411 Fixes and a Windows Zero-Day Under Attack

Microsoft's October security update, released on 13 October, fixed 1,411 vulnerabilities according to BleepingComputer's count, the largest Patch Tuesday on record. Other trackers counted slightly different totals, between about 1,400 and 1,413, depending on which products they included. One flaw was already being exploited in attacks, and two more had been disclosed publicly before the fix.

Ten days on, it is worth checking that the update has actually been installed: the volume makes it easy for a few systems to fall behind.

The exploited zero-day

CVE-2026-96951 is a security feature bypass in Windows Shell that lets malicious files avoid Mark of the Web warnings, the prompts Windows shows for files downloaded from the internet. Those warnings are one of the main things standing between a user and a malicious attachment or download, which is why bypasses of this kind are popular with attackers. Microsoft has not shared details of how it was exploited. CISA added it to its Known Exploited Vulnerabilities catalogue and gave US federal agencies until 16 October to fix it.

Two publicly disclosed flaws

• CVE-2026-108398, .NET Framework: a security feature bypass reported by James Forshaw of Google Project Zero. Microsoft says it could let attackers get around Windows Defender Application Control and run applications that should be blocked.
• CVE-2026-92707, MessagePack-CSharp: a denial of service flaw.

Why so many

Seventy of the fixes are rated critical: 57 remote code execution flaws, 11 elevation of privilege flaws and two spoofing flaws. By category, elevation of privilege made up the largest share, at 677, followed by 317 remote code execution flaws.

BleepingComputer attributes the record size to Microsoft's continued use of AI tools to find and fix vulnerabilities in its own products. To make the list more manageable, Microsoft has started grouping related flaws into "risk cohorts"; the largest cover Windows filesystems, storage and backup, Office documents and mail clients, and Windows graphics and media processing. Microsoft describes the cohorts as experimental and says they do not indicate which flaws are most dangerous.

Versions that are out of support

• Windows 11 version 24H2 Home and Pro and Windows 10 Enterprise LTSB 2016 received their last update in October.
• Windows 11 23H2 Enterprise, Education and IoT Enterprise stop receiving security updates from next month.

Machines on these versions need to move to a supported release to keep getting fixes.

What to do

1. Confirm the October update is installed across servers and endpoints, starting with machines that open email and web downloads, since CVE-2026-96951 targets exactly that path.
2. Prioritise internet-facing servers and domain infrastructure among the critical fixes, including CVE-2026-70229 in Active Directory Domain Services.
3. Plan upgrades for the Windows editions that have reached the end of support.
4. Do not stop at Microsoft. This month's actively exploited flaws also include firewalls, email gateways and remote access tools from other vendors.