Windows October Patch Tuesday fixes 1,411 flaws and three zero-days

A file delivered by email can lose the warning that normally marks it as coming from the internet. Microsoft's October updates fix the Windows Shell flaw behind that bypass, part of a Patch Tuesday release covering 1,411 vulnerabilities across its products. Two more zero-days had been disclosed publicly before the updates arrived. Microsoft released the fixes on October 13, 2026. Windows was affected, along with Office and .NET. SharePoint Server was covered too, as were other products.

The exploited vulnerability, CVE-2026-96951, is a command-injection flaw rated 8.8 on the CVSS scale. Microsoft classifies it as a security-feature bypass, not remote code execution. It gets around Mark of the Web, or MOTW, which flags files from potentially untrusted sources. That can stop SmartScreen and Office Protected View warnings from appearing when someone opens a malicious file. The attack requires a user to open a specially crafted file sent by email or message. It needs no prior authentication or privileges. Microsoft has not identified the attackers or the campaigns involved.

For manual installs, put the Windows Shell fix first.

Three zero-days and a shifting vulnerability count

CISA added CVE-2026-96951 to its Known Exploited Vulnerabilities catalog on October 13. Federal agencies have until October 16 to address it. The other two zero-days were publicly disclosed, but were not reported as exploited. CVE-2026-108398 affects .NET Framework and bypasses Windows Defender Application Control. CVE-2026-92707 affects MessagePack-CSharp and can cause denial of service by exhausting memory. CrowdStrike's October Patch Tuesday analysis describes the MOTW bypass and its effect on SmartScreen and Office Protected View.

There is no single agreed Patch Tuesday total. Action1 counted 1,409 flaws; BleepingComputer counted 1,411. SecurityOnline put the figure at 1,414, while Petri reported 1,415. SecurityWeek counted 1,413. Tenable's methodology found 1,407 CVEs across 301 products and components. Its tally includes 69 critical vulnerabilities. Another 1,337 are rated important. One is low severity.

The Microsoft Security Response Center feed lists 1,760 entries. But 348 involve flaws fixed before Tuesday, mostly in Azure services. Exchange Server is also represented. Dataverse and Partner Center account for other earlier fixes. BleepingComputer's 1,411 figure excludes them. SecurityWeek assigns 1,102 fixes to Windows. Its count gives Office 134 and developer tools 61. SharePoint Server accounts for 36.

The October tally includes 677 elevation-of-privilege flaws. Remote-code-execution issues number 317. Information-disclosure flaws total 254. Denial-of-service vulnerabilities account for 73. There are 40 security-feature bypasses. Spoofing flaws number 28. Seventy vulnerabilities are rated critical, including 57 remote-code-execution issues.

Server systems need attention alongside Windows PCs

Among the critical remote-code-execution vulnerabilities listed in the MSRC feed, Office has 11 in Excel. Outlook accounts for four. Visio and PowerPoint have three each, while Word has two. Windows DHCP Server has five. Hyper-V and Microsoft QUIC have two each. Remote Desktop Services has one. Exchange Server has one too. Active Directory Domain Services has one, CVE-2026-70229.

A compromised domain controller can put an organization at greater risk than a large number of PCs updated late. Administrators should review DHCP Server. Exposed services such as Exchange or a Remote Desktop Gateway belong near the front of the update queue.

This is the second Windows Shell security-feature bypass reported as exploited this year. In February, Microsoft fixed CVE-2026-21510 after attackers used a crafted shortcut file to evade SmartScreen warnings.

Install the updates and verify the rollout

Windows 11 cumulative updates include KB5127648 for versions 24H2, 25H2 and 26H2. They also include KB5126653. Windows 10 receives KB5126657 through the Extended Security Update program, taking the build to 19045.7807. Updates are available through Windows Update or WSUS.

October also ends security support for Windows 11 24H2 Home and Pro. Support for Windows 10 Enterprise LTSB 2016 ends as well. Windows 11 23H2 Enterprise, Education and IoT Enterprise are due to lose support in November. Devices running those editions need to move to a supported build to receive future fixes.

Test the update on a small group of devices before a broad rollout. September's KB5124008 caused boot problems. It also disrupted VPN connections and backups before Microsoft issued an emergency update. The current report also flags ShieldCrash, a Defender bug that bypasses a Microsoft patch. Defender flaw analysis describes a related file-reading route on updated Windows systems.

Microsoft and several analysts attribute the rising number of reported defects in part to AI-assisted bug hunting. The monthly total rose from 206 fixes in June to 622 in July. October reached 1,411. September's count ranged from 966 to 997, depending on the source. The actively exploited Shell flaw is the clearest immediate priority in October's release, while the remaining patches still need a tested rollout. Tenable's October release breakdown also classifies CVE-2026-96951 as a security-feature bypass that relies on social engineering and user interaction.