MICROSOFT’S October 2026 Patch Tuesday fixes a record 1,414 vulnerabilities, including 78 rated critical, making it the largest Microsoft release to date. The update slate includes three zero-day flaws, with one already being actively exploited. CISA has urged federal agencies to apply the patch for the exploited flaw by 16 October 2026.
The most urgent fix is for CVE-2026-96951, described as an exploited Windows Shell security feature bypass that enables command injection and could allow an unauthorised attacker to bypass Mark of the Web warnings. Microsoft has not disclosed who is exploiting it or the exact attack chain.
Two other zero-days, CVE-2026-108398 and CVE-2026-92707, are publicly disclosed; exploitation status for these is not confirmed, though CVE-2026-108398 could bypass Windows Defender Application Control and execute code within a protected process.
Affected products span Windows, the .NET Framework and related Microsoft services. In practice, organisations should prioritise patching CVE-2026-96951 first, followed by updates to the .NET Framework used with Windows Defender Application Control. Beyond the zero-days, there are 78 critical fixes that require testing, with emphasis on internet-facing systems. Users are advised to treat downloaded files with extra caution until patches land.
Microsoft lists affected versions and update paths in the Security Update Guide, with patches available under entries such as 20260925.100, 10.0.14393.9612, 10.0.17763.9376 and 10.0.19044.7807 (+15).