Microsoft October 2026 Patch Tuesday fixes 1,411 flaws

Microsoft's October 2026 Patch Tuesday (the company's regular monthly security release) addresses 1,411 vulnerabilities, a new record. Three of them are zero-days: one is being actively exploited, and two were publicly disclosed before a fix was available.

Seventy of the bugs are rated "Critical." Of those, 57 allow remote code execution, 11 allow elevation of privileges and 2 are spoofing issues.

Broken down by category, the release includes roughly 677 elevation of privilege flaws, 317 remote code execution flaws, 254 information disclosure bugs, 73 denial of service issues, 40 security feature bypasses and 28 spoofing vulnerabilities.

The total does not count 348 flaws Microsoft fixed earlier in the month. Those affected services and products such as Azure App Service, Azure Event Grid, Azure SRE Agent, Microsoft Dataverse and Microsoft Exchange Server. According to BleepingComputer, the record volume comes as Microsoft keeps using AI platforms to find and fix vulnerabilities in its software.

End of the road for some Windows editions

Microsoft also confirmed that Windows 11 version 24H2 Home and Pro, and Windows 10 Enterprise LTSB 2016, are now out of support.

"The October 2026 monthly security update is the last update available for these editions," the company said.

Earlier in October, Microsoft warned that Windows 11 23H2 Enterprise, Education and IoT Enterprise will stop receiving security updates starting next month. Organizations running those editions are advised to upgrade.

The zero-day being exploited

The actively exploited flaw, CVE-2026-96951, is a security feature bypass in Windows Shell. It lets attackers get around Mark of the Web, the Windows feature that flags files downloaded from the internet so they are handled with more caution.

Microsoft describes it as a command injection issue that "allows an unauthorized attacker to bypass a security feature over a network." The company has not said how the flaw was used in attacks or who reported it.

Two publicly disclosed bugs

The first disclosed zero-day, CVE-2026-108398, affects the .NET Framework. It is an untrusted search path issue that can be used to bypass Windows Defender Application Control (WDAC), the Windows feature that restricts which applications are allowed to run.

"An authenticated attacker could place a specially crafted .NET assembly on an affected system and register it for loading by a protected process," Microsoft explained. A successful attack could let the attacker run code inside the protected process, and no user interaction is needed. James Forshaw of Google Project Zero found the flaw.

The second, CVE-2026-92707, is a denial of service bug in MessagePack-CSharp. Improperly controlled memory allocation in .NET lets an unauthenticated attacker knock a service offline over the network. Microsoft did not name who disclosed it.

Grouping flaws into "risk cohorts"

Given the size of this release, Microsoft is testing a new way to help administrators decide what to patch first. It groups related vulnerabilities into "risk cohorts" and published 15 of them for October.

The largest cohorts cover Windows filesystems, storage and backup (136 flaws), Office documents and mail clients (135), Windows graphics, media and content processing (131), Windows core and kernel privilege boundaries (109), and Windows installation, deployment and update services (103).

Microsoft stressed that a cohort does not signal which flaws are the most dangerous. Real risk still depends on active exploitation, severity and how a given organization uses the software. The company calls the approach experimental and says it supplements, rather than replaces, its existing guidance.

Other vendors this month

Microsoft was not alone. Fortinet, Ivanti and SonicWall all patched flaws that attackers exploited, and Citrix fixed a NetScaler zero-day tracked as CVE-2026-88779. Adobe, Atlassian, Cisco, Dell, Docker, GitLab, Kiteworks, Progress Software and SAP also shipped security updates.

Our take

A release of more than 1,400 fixes in a single day is a heavy load for any patching team, and the jump from 966 flaws in September suggests that AI-assisted bug hunting is now producing results at a scale vendors are struggling to package. The risk cohort experiment reads as an admission that raw counts and severity labels alone no longer help defenders much.

The immediate priority is still clear: the Mark of the Web bypass is being exploited, and similar bypasses have often been paired with phishing lures. The end-of-support dates also deserve attention, especially alongside the Windows Update certificate expiry that will affect older machines. It is worth watching whether monthly totals keep climbing, and whether Microsoft's cohorts turn out to be useful enough to become a permanent part of its guidance.