Microsoft’s October 2026 Patch Tuesday is the biggest it has ever shipped. Depending on how you count, it fixes somewhere between 1,118 and 1,411 vulnerabilities — and one of them is already being exploited.
Nobody can review a thousand-plus CVEs one by one. So instead of a list, this article gives you a prioritised plan: what to patch in the first 48 hours, what can wait a week, and which deadlines you can’t miss.
October 2026 Patch Tuesday at a glance
- Released: 13 October 2026
- Vulnerabilities fixed: 1,411 according to BleepingComputer’s count; Microsoft’s own risk-cohort briefing covers 1,118. The difference comes down to what’s counted (for example, open-source components shipped in Azure Linux/Mariner and fixes released earlier in the month).
- Zero-days: 3 — one actively exploited, two publicly disclosed
- Critical: 70 (57 remote code execution, 11 elevation of privilege, 2 spoofing)
- Biggest category: elevation of privilege, roughly 677 flaws, followed by around 317 remote code execution bugs
The zero-days
CVE-2026-96951 — Windows Shell security feature bypass (actively exploited)
This is the one to patch first. A command-injection flaw in Windows Shell lets an attacker bypass Mark of the Web (MotW) — the tag Windows adds to files downloaded from the internet. MotW is what triggers SmartScreen warnings and Office Protected View, so bypassing it is a classic way to make a malicious download or attachment run without the usual warnings.
Microsoft hasn’t shared who is exploiting it or how. MotW bypasses have historically been popular with phishing and malware-delivery campaigns, so treat every Windows endpoint where users open email or browse the web as in scope.
CVE-2026-108398 — .NET Framework security feature bypass (publicly disclosed)
Discovered by James Forshaw of Google Project Zero. An untrusted search path issue can let an authenticated attacker bypass Windows Defender Application Control (WDAC) and run code in a protected process, with no user interaction. If you rely on WDAC for application allowlisting, this one matters.
CVE-2026-92707 — MessagePack-CSharp denial of service (publicly disclosed)
A memory-allocation flaw in the MessagePack-CSharp library allows remote denial of service. Note that a Windows update alone won’t fix this — applications that bundle the library need to update their dependency. Ask your developers or vendors.
Microsoft’s new “risk cohorts”
To make a release this large manageable, Microsoft introduced an exploratory approach: grouping CVEs into 15 risk cohorts that raise the same assessment questions about your environment, rather than sharing a root cause or score. The largest cohorts this month:
| Risk cohort | CVEs |
|---|---|
| Windows filesystems, storage and backup | 136 |
| Office document and mail clients | 135 |
| Windows graphics, media and content processing | 131 |
| Windows core and kernel privilege boundaries | 109 |
| Windows installation, deployment and update services | 103 |
| DNS, DHCP and network-address infrastructure | 76 |
| Windows device, peripheral and print surfaces | 76 |
| Remote-access and RDP deployments | 65 |
| Windows authentication, credentials and cryptography | 61 |
| Directory, federation and certificate infrastructure | 24 |
The idea: answer a question like “where do we expose RDP?” once, and apply it to all 65 RDP-related CVEs. Microsoft is explicit that cohorts don’t change patching instructions or urgency, and don’t replace checking each advisory for exploitation status. Use them to organise your review, not to skip it.
Patch priority plan
First 48 hours
- All Windows workstations for CVE-2026-96951 (exploited MotW bypass). Start with users who handle external email.
- Domain controllers and identity infrastructure. Critical fixes include CVE-2026-70229 (Active Directory Domain Services RCE) and two AD FS spoofing flaws (CVE-2026-96222 and CVE-2026-108131). Compromise here means compromise of everything — see our Active Directory guide for why.
- Internet-facing servers, especially anything in the RDP, DNS/DHCP and web/RPC cohorts.
Within a week
- Systems relying on WDAC (CVE-2026-108398).
- Azure-hosted workloads: critical fixes this month touch Azure App Service, API Center, Event Grid and the Azure SRE Agent — check which are customer-actionable in the Security Update Guide.
- Office and mail clients (135 CVEs) across the rest of the fleet.
- Applications bundling MessagePack-CSharp (CVE-2026-92707).
Normal cycle
Everything else, tested and deployed through your standard process.
End-of-support deadlines
- Windows 11 24H2 Home and Pro and Windows 10 Enterprise LTSB 2016 received their last security update this month.
- Windows 11 23H2 Enterprise, Education and IoT Enterprise stop receiving security updates from next month.
Any machine still on these versions after this month will accumulate unpatched vulnerabilities. Plan upgrades now.
It’s not just Microsoft this month
October has been brutal for edge and enterprise software. Other urgent items:
- Citrix NetScaler — ten CVEs, several exploited as zero-days. Read our guide: why patching NetScaler isn’t enough.
- Fortinet — FortiMail CVE-2026-104286 exploited as a zero-day, plus the ongoing FortiBleed credential campaign against FortiGate.
- Ivanti Connect Secure — an actively exploited zero-day.
- SonicWall SMA1000 — a critical SSRF exploited within two days of disclosure.
- Atlassian — critical CVE-2026-21589 in Confluence, Jira and Bitbucket Data Center, exploited after a proof of concept was released.
- Cisco NX-OS, SAP (including a maximum-severity OAuth2 SSRF in the Cloud SDK for Python), GitLab, Docker Hub and Dell also shipped critical fixes.
If you have to choose, internet-facing edge devices with known exploitation come before almost anything else. They are the most common way into networks today, and the starting point for most ransomware attacks.
