October 2026 Patch Tuesday: 1,400 Fixes, Exploited Windows Shell Zero-Day and Support Deadlines

BleepingComputer reports that the release covers a record-breaking 1,411 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities. Other outlets give different totals for the same release. The reasons matter if you report patch metrics to management.

So how many flaws were fixed? It depends on who's counting​

The number in a Patch Tuesday headline depends on what the counter decides to include. Here is what each outlet reports:

Action1 says that Microsoft's October 2026 Patch Tuesday includes 1,409 patches, far surpassing September's record of 995. Among them are 80 critical vulnerabilities and two zero-days. NTCompatible puts it at roughly 1,413 CVEs across 176 distinct updates, spanning Windows, Office, SharePoint, SQL Server, Exchange, developer tools, Azure, and Defender. Cyber Security News bases its lower figure on Microsoft's cohort briefing, which outlines 1,118 vulnerabilities across 15 risk groups.

Three groups of outlets land close together, at 1,409, 1,411 and about 1,413. The 1,118 figure comes from the cohort briefing, and the 15 cohort counts add up to exactly 1,118. One plausible explanation, which is our inference rather than anything Microsoft has said, is that the cohort document doesn't cover every CVE in the release. Microsoft has not published a single reconciled number. Treat "about 1,400" as the consensus figure and 1,118 as the size of the cohort map.

BleepingComputer's severity breakdown:

• 70 Critical flaws: 57 remote code execution, 11 elevation of privilege and 2 spoofing
• By impact (approximate): 677 elevation of privilege, 317 remote code execution, 254 information disclosure, 73 denial of service, 40 security feature bypass and 28 spoofing

These categories add up to 1,389, not 1,411. BleepingComputer calls them approximate. Action1's tally of 80 critical flaws differs because it counts differently.

BleepingComputer also says the 348 flaws fixed earlier in October were left out of its total. They include fixes for Azure API Center, Azure App Service, Azure Event Grid, Azure SRE Agent, Mariner, Microsoft Bookings, Dataverse, Exchange Server and Partner Center. Many of these are cloud-side fixes that need no action from customers. Exchange Server is the exception. If you run it on-premises, check that it's patched.

Section summary: Expect roughly 1,400 fixes, about 70–80 of them critical, depending on the source. Counts differ because outlets include different CVEs, so pick one counting rule and use it consistently in your own reports.

The zero-days: one exploited, two disclosed​

Microsoft calls a flaw a zero-day if it was publicly disclosed or actively exploited before a fix existed. Only one of the three in this release has been used in attacks.

CVE-2026-96951: Windows Shell security feature bypass (actively exploited)​

This is the urgent one. BleepingComputer reports that Microsoft patched an actively exploited zero-day security bypass flaw that allowed attackers to bypass the Mark of the Web security feature.

Microsoft describes it as a command-injection weakness in Windows Shell that lets an unauthorized attacker bypass a security feature over a network. It has not said how the flaw was used in attacks or who reported it.

Why it matters: Windows attaches Mark of the Web (MotW) to files downloaded from the internet. That tag is what triggers SmartScreen checks, Office Protected View and the "are you sure?" prompts. If attackers can strip or avoid it, a malicious download looks like a trusted local file. Phishing and malware-loader campaigns have relied on MotW bypasses for years, a point based on general industry experience. NTCompatible's advice matches: Patch the Windows Shell zero-day first across anything exposed or remote.

CVE-2026-108398: .NET Framework security feature bypass (publicly disclosed)​

Microsoft describes this as an untrusted search path flaw that lets an authorized attacker bypass a security feature locally. In practice, it can get around Windows Defender Application Control (WDAC) enforcement.

According to Microsoft's advisory as quoted by BleepingComputer, the attack works like this:

1. An authenticated attacker places a specially crafted .NET assembly on the system.
2. The attacker registers it to be loaded by a protected process.
3. The code then runs inside that process and escapes WDAC restrictions, with no user interaction needed.

James Forshaw of Google Project Zero found the flaw. An attacker needs an account on the machine first, so this isn't a drive-by threat. It's still serious for anyone who relies on WDAC or App Control allowlisting to stop an intruder who already has a foothold. In those environments, this is a priority patch.

CVE-2026-92707: MessagePack-CSharp denial of service (publicly disclosed)​

Microsoft says improperly controlled sequential memory allocation in .NET lets an unauthorized attacker cause a denial of service over a network. It has not named who disclosed it.

This flaw is in a serialization library, so its reach depends on which of your .NET applications and services use MessagePack-CSharp. Developers should check their dependency trees, update the package and rebuild. A Windows update alone won't fix it.

Action1 counts only "two zero-days." That probably reflects a different definition, not a disagreement about the facts. The CVE details above are as Microsoft described them to BleepingComputer.

Section summary: Fix CVE-2026-96951 first everywhere. Then fix CVE-2026-108398 on systems where WDAC enforcement matters. Developers should update MessagePack-CSharp in their applications.

Risk cohorts: Microsoft's new way to sort the pile​

With this many CVEs, Microsoft tried something new. Netizen reports that Microsoft introduced an experimental vulnerability assessment approach called risk cohorts, organizing the month's vulnerabilities into 15 groups based on shared exposure characteristics and remediation considerations.

Each cohort is built around a question about your environment. For the largest cohort, Cyber Security News says the shared question is Which filesystem, storage, and backup features handle untrusted local input, disk images, media, or workloads?

The 15 cohorts, as reported by Threadlinqs and partly confirmed by Cyber Security News and Netizen:

There are limits. Microsoft stresses that cohorts don't rank danger. Real risk still depends on whether a flaw is being exploited, how severe it is and how you use the affected software. Microsoft calls the approach experimental, and it doesn't replace assessing each CVE in the Security Update Guide.

Our take: cohorts suit the way IT teams actually work. You answer "do we expose RD Gateway?" once and apply that answer to 65 CVEs. The risk is that a busy team treats the largest cohorts as the most urgent. The most dangerous flaw this month, the Shell zero-day, is a single CVE that a size-based ranking would bury.

NTCompatible also notes that Microsoft announced general availability of Hotpatching for Windows Server 2025 Azure Edition VMs alongside the cohorts.

Windows updates, builds and how to install them​

Microsoft's support page for KB5127648 lists these builds for Windows 11:

• 26H2: build 26300.9711
• 25H2: build 26200.9711
• 24H2: build 26100.9711

The update is available through Windows Update, Windows Update for Business, the Microsoft Update Catalog and WSUS. For WSUS, sync Product "Windows 11" with Classification "Security Updates." It includes servicing stack update KB5127647 (build 26100.9703). Other releases this month are Windows 11 KB5126653 and Windows 10 extended security update KB5126657.

Manual install from the Update Catalog:

1. Download every MSU file for KB5127648 into one empty folder, for example C:\packages. That includes the required checkpoint update (windows11.0-kb5043080-x64.msu or the arm64 version).
2. Install them in order: the checkpoint update first, then windows11.0-kb5127648-x64.msu.
3. Or let DISM install them in the right order from an elevated prompt:
   DISM /Online /Add-Package /PackagePath:c:\packages\windows11.0-kb5127648-x64.msu
4. To check it worked, run winver and confirm the build number matches your version.

Things to watch for:

• USB audio: Some USB Audio Class 1.0 devices may still show Code 10 errors or play no sound. This problem dates back to the September 8 update. The September 14 out-of-band update KB5129195 fixed only the 8-channel and 3D audio symptoms. Some users have restored sound by switching to 2-channel mode.
• Image servicing: If you add this update to installation media, include boot.stl. Without it, devices can fail to boot from that media with error 0xc0430001.
• Fixes in this release: Microsoft lists fixes for Explorer black screens on Azure Virtual Desktop and FSLogix, Always On VPN connections stuck on "Connecting," and Storage Spaces Direct disks that wouldn't come online.

Support deadlines arrived with this update​

For some machines, this is the last update they'll get. Microsoft's lifecycle page and the KB5127648 notes confirm:

• Windows 11 24H2 Home and Pro got their last update on October 13, 2026. Microsoft recommends moving to a newer Windows 11 version.
• Windows 10 2016 LTSB and Windows 10 IoT Enterprise LTSB 2016 also reached end of support on October 13.
• Office 2021 and Office LTSC 2021 apps, plus Windows Server 2012/2012 R2 ESU Year 3, appear on Microsoft's lifecycle page with the same October 13 date.
• Windows 11 23H2 Enterprise, Education and IoT Enterprise stop receiving updates on November 10, 2026, so you have one more Patch Tuesday to upgrade them.

Bottom line​

BleepingComputer links the jump in CVE numbers to Microsoft's use of AI to find vulnerabilities. Nobody has shown that AI caused the increase. What's clear is that volumes have kept climbing: Netizen notes this release follows September's 973 vulnerabilities and July's 570.

The order of work is:

1. Patch the Shell zero-day.
2. Fix the WDAC bypass where application control matters.
3. Use the cohorts to decide what else to roll out first, without letting them replace exploitation status as your top signal.
4. Upgrade any device running an edition that just lost support.