Microsoft's Record October Patch Tuesday: 1,411 Fixes and a Windows Zero-Day Under Attack

Microsoft's October security update, released on 13 October, fixed 1,411 vulnerabilities, which BleepingComputer calls the largest Patch Tuesday on record. One flaw was already being exploited. Two more had been disclosed publicly before the fix.

The exploited zero-day

CVE-2026-96951 lets a malicious file slip past Mark of the Web, so Windows doesn't show its warning for something downloaded from the internet. Tenable's analysis puts its CVSS score at 8.8 and notes that the target has to be talked into opening a crafted file. Microsoft hasn't said how it was exploited. CISA added it to the Known Exploited Vulnerabilities catalogue on 13 October and gave US federal agencies until 16 October to fix it.

Two publicly disclosed flaws

The more serious is CVE-2026-108398 in .NET Framework. Microsoft says an attacker who can already place a crafted .NET assembly on a machine could get it loaded by a protected process, bypass Windows Defender Application Control and run code there. James Forshaw of Google Project Zero found it, BleepingComputer reports. The other, CVE-2026-92707, is a denial-of-service bug in the MessagePack-CSharp library, rated moderate.

What's in the release

Of the total, 70 fixes are rated critical: 57 remote code execution, 11 elevation of privilege and two spoofing. Across all severities elevation of privilege leads with 677 flaws, ahead of 317 for remote code execution. BleepingComputer puts the record down to Microsoft's use of AI platforms to find and fix flaws in its own products.

To help teams sort the list, Microsoft has started grouping related flaws into 15 "risk cohorts". It calls the approach exploratory and says a cohort doesn't set priority by itself.

Versions losing support

October's update is the last for Windows 11 version 24H2 Home and Pro and for Windows 10 Enterprise LTSB 2016. Windows 11 23H2 Enterprise and Education reach end of updates on 10 November, after one more security update.

What to do

Check that the 13 October cumulative update is on every Windows machine, starting with the ones people use to open email and downloads:

• Windows 11 24H2, 25H2 and 26H2: KB5127648, builds 26100.9711, 26200.9711 and 26300.9711.
• Windows 11 23H2: KB5126653, build 22631.7652.
• Windows 10 21H2 (Enterprise LTSC 2021) and 22H2 (Extended Security Updates only): KB5126657, builds 19044.7807 and 19045.7807.

Windows Server KB numbers are in Microsoft's October release notes.

On 26 October Microsoft added out-of-band update KB5134133 for Windows 11 24H2 to 26H2, meant for machines that don't pull certificate trust list updates automatically. It carries the root certificate changes that Microsoft's response to the compromised eMudhra keys describes (background in the eMudhra intermediate CA compromise).

Among servers, patch domain controllers first: CVE-2026-70229, a critical remote code execution flaw in Active Directory Domain Services, can be triggered with a crafted packet, and Microsoft rates exploitation as more likely, according to Tenable.