October 2026 Patch Tuesday: Record Fixes and an Exploited Zero-Day

admin — Sun, 18 Oct 2026 16:35:02 +0000

Microsoft’s October 2026 Patch Tuesday, released on 13 October, is the biggest monthly security update the company has ever shipped. Security researchers who track the release counted well over 1,400 fixed vulnerabilities across Windows, Office, SharePoint, SQL Server, Exchange Server, Azure and developer tools. Exact totals differ slightly between trackers (figures between roughly 1,411 and 1,416 have been published, depending on what each counts), but every analysis agrees on the headline: this is a very large update and it contains at least one flaw that attackers are already using.

For small businesses and home users, the size of the release matters less than one practical question: which machines do you need to update, and how quickly? This article explains what is in the update, which items deserve the most attention, and what you should do this week.

The zero-day you should patch first

The most urgent item is CVE-2026-96951, a security feature bypass in the Windows Shell. According to analyses of the release, the flaw lets attackers get around Mark of the Web, the Windows protection that tags files downloaded from the internet so that Office, SmartScreen and other tools treat them with extra caution. When that tag is bypassed, a malicious file sent by email or downloaded from a website can open without the usual warnings.

Microsoft has marked this vulnerability as exploited in the wild, and the US Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalogue, giving US federal agencies a deadline of 16 October to patch. That deadline applies to US government networks only, but it is a useful signal: if a national cyber agency wants it fixed within days, businesses everywhere should treat it the same way.

Two other issues were reported as publicly disclosed before a fix was available:

CVE-2026-108398, a .NET Framework security feature bypass that, according to Windows Report, can let an authenticated attacker get around Windows Defender Application Control (WDAC).
CVE-2026-92707, a denial-of-service issue in the MessagePack-CSharp library caused by uncontrolled memory allocation.

Publicly disclosed does not mean exploited, but it does mean the details are already out there, which shortens the time before criminals try to use them.

Photo: “Office Computing” by Steve Parker, CC BY 2.0, via Openverse

Where the rest of the fixes landed

Qualys’ breakdown shows Windows accounts for the overwhelming majority of the fixes, with Office, developer tools, SharePoint Server, SQL Server, Azure and Exchange Server making up most of the remainder. Around 70 to 78 of the flaws are rated Critical, depending on the tracker, and most of those are remote code execution bugs, the type that can let an attacker run their own programs on a target system.

Several critical items stand out for organisations that run their own servers:

Exchange Server remote code execution (CVE-2026-70571). On-premises Exchange servers are a long-standing favourite target, so update them promptly.
Windows QUIC remote code execution (CVE-2026-105016), relevant to systems handling modern network traffic.
Active Directory Federation Services spoofing (CVE-2026-108131), important for organisations that use AD FS for sign-in.
Hyper-V remote code execution (CVE-2026-102214), important for anyone running virtual machines on Windows servers.

Reporting on the release links the unusually high number of fixes to Microsoft’s growing use of AI tools to hunt for weaknesses in its own code. Whatever the cause, larger releases put more strain on IT teams, so it helps to have a clear order of work rather than trying to do everything at once.

Android’s October bulletin

Google’s Android security bulletin for October 2026 fixes 25 vulnerabilities in the Framework and System components, with the 2026-10-01 patch level. SecurityWeek reports that seven of them are rated critical, and the most severe is a System flaw that could allow local elevation of privilege without any user interaction. Google did not report any of these bugs as exploited. Pixel phones received a separate set of fixes, including three critical issues.

Android updates reach phones at different speeds depending on the manufacturer and the carrier, so the only reliable check is the security patch level shown on your own device.

Two end-of-support dates that came with this update

October’s Patch Tuesday was also the last scheduled security update for Windows 11 version 24H2 Home and Pro editions, which reached end of support on 13 October 2026. Office LTSC 2021, Visio LTSC 2021 and Project LTSC 2021 also reached end of support on the same date. Devices still running these versions will keep working, but they will no longer receive security fixes, so plan upgrades now rather than after a problem appears.

What you should do

Update Windows PCs this week. Open Settings, go to Windows Update, select Check for updates, install everything offered and restart. A pending restart means the fix is not yet active.
Prioritise servers. Patch Exchange, SharePoint, Hyper-V hosts and AD FS servers first, after a quick backup.
Be extra careful with downloaded files until every machine is patched, since the exploited bug weakens download warnings.
Check Android phones. Go to Settings, then About phone or Security, and confirm the patch level is 2026-10-01 or later. Install any waiting system update.
Move off unsupported software. Upgrade PCs still on Windows 11 24H2 Home or Pro to a supported version, and plan replacements for Office LTSC 2021.
Keep a simple patch log listing each device, the date it was updated and anything that failed, so nothing slips through.

Sources

Featured image: Photo: “My first 5 minute attempt at a transparent screen” by plindberg, CC BY 2.0, via Openverse — source