Microsoft shipped Patch Tuesday October 2026 on 13 October, fixing about 1,413 vulnerabilities. One of them, CVE-2026-96951 in Windows Shell, was already being exploited before the patch existed. CISA added it to its catalogue of known exploited flaws the same day and set a 16 October deadline for United States federal agencies.
The One Flaw to Install First
CVE-2026-96951 is the only vulnerability in this batch that attackers were already using. It is a security feature bypass in Windows Shell, the component behind the desktop, taskbar and File Explorer, and it carries a CVSS score of 8.8. The Cybersecurity and Infrastructure Security Agency, the United States federal cyber defence agency known as CISA, catalogues it as a Microsoft Windows command injection vulnerability.
What it defeats is Mark of the Web. That is the hidden tag Windows attaches to any file arriving from the internet or an email, and it is what makes Office open a document in Protected View and makes Windows warn you before running a downloaded program. Strip the tag and a malicious file opens as though it came from your own hard drive, with no warning.
Exploitation is not silent. According to Rapid7, an attacker has to get the target to open a specially crafted file or visit a site the attacker controls, and Microsoft’s own assessment is that an attacker cannot force a user to view attacker-controlled content. Tenable notes this is the third Windows Shell flaw exploited in the wild during 2026. SecurityWeek reports that researchers at Fujitsu and Anthropic, along with an independent researcher, reported the flaw.
To confirm you are covered:
- Open Settings, then Windows Update, and choose Check for updates.
- Install the October 2026 cumulative update offered for your Windows version and restart.
- Check the installed update under Update history, and confirm your build has moved past the October release.
- On Windows Server 2012, note that Rapid7 reports no patch was issued; Server 2012 R2 did receive one.
Who the 16 October Deadline Actually Binds
The 16 October date is a federal obligation in the United States, not a general one. CISA added CVE-2026-96951 to its Known Exploited Vulnerabilities catalog on 13 October with a required action due date of 16 October 2026.
The instrument behind it is Binding Operational Directive 26-04, “Prioritizing Security Updates Based on Risk”, which applies to Federal Civilian Executive Branch agencies. It requires those agencies to move quickly on high-risk catalogued flaws on publicly exposed systems, lets them defer lower-risk ones, and sets expectations for checking whether a system was already compromised before the patch landed. CISA says vulnerabilities of this kind “are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise”.
Everyone else is encouraged rather than compelled. CISA’s advice to other organisations is to prioritise catalogued flaws as part of risk-based vulnerability management. The same alert added a second flaw, the Ivanti Connect Secure authentication bypass tracked as CVE-2026-104935, under the same deadline. The compromise-check expectation matters: as with the NetScaler zero-days patched in September, patching a flaw that was exploited first does not undo an intrusion that already happened.
Why the CVE Count Differs Depending on Who Counts
No two write-ups of this release agree on the total, because each counts a different set. The figures published range from 1,407 to 1,415.
| Source | CVEs | Rated Critical | What it counts |
|---|---|---|---|
| Tenable | 1,407 | 69 | Across 301 products and components |
| BleepingComputer | 1,411 | 70 | Patch Tuesday day only, excluding 348 fixed earlier in October |
| Rapid7 | 1,413 | Not stated | Microsoft own-product vulnerabilities |
| SecurityWeek | 1,413 | Not stated | Total CVEs in the release |
| Petri | 1,415 | About 80 | Total CVEs in the release |
One reason the numbers move is Microsoft Edge. Rapid7 reports that Microsoft’s Security Update Guide listed no Edge vulnerabilities for the first 13 days of October, with release notes saying CVEs would be added when available, so Edge fixes sit outside these totals. Third-party code counted under Microsoft’s banner shifts the figure too.
By product, SecurityWeek’s breakdown puts 1,102 of the CVEs in Windows, 134 in Office, 61 in developer tools and 36 in SharePoint Server, with the remainder spread across Exchange Server, Azure and Defender. SecurityWeek also reports that Microsoft has now patched more vulnerabilities in this one month than in the whole of 2025, and that its 2026 total has passed 4,000. That comparison comes from a single outlet.
The Two Zero-Days Nobody Is Exploiting Yet
Two further flaws were public before a fix shipped, but neither is known to be under attack.
- CVE-2026-108398, .NET Framework: a security feature bypass scored 8.8 that lets an attacker who already has local access defeat App Control for Business, previously called WDAC, and run code inside a protected process. James Forshaw of Google Project Zero found it.
- CVE-2026-92707, MessagePack-CSharp: a memory allocation flaw in a third-party serialisation library that allows an unauthenticated attacker on the network to cause a denial of service.
Critical Flaws Worth a Second Look
Beyond the zero-days, a handful of server-side flaws stand out in Tenable’s analysis. Exchange and Active Directory are the exposed surfaces here, and Rapid7 separately flags multiple Outlook remote code execution flaws that need no user interaction.
| CVE | Product | Type | CVSS |
|---|---|---|---|
| CVE-2026-70279 | Exchange Server | Spoofing | 9.3 |
| CVE-2026-70229 | Active Directory Domain Services | Remote code execution | 8.1 |
| CVE-2026-70571 | Exchange Server | Remote code execution | 8.1 |
| CVE-2026-96940 | Exchange Server | Elevation of privilege | 8.8 |
| CVE-2026-88159 | Windows BITS | Remote code execution | 8.8 |
Tenable marks each of these “Exploitation More Likely”, Microsoft’s own forecast that attackers will find them worth the effort. The Active Directory flaw is reachable by sending a crafted packet, and the Exchange remote code execution flaw by sending a malicious email.
What Lost Support in the Same Week
This release doubles as a cut-off date for an unusual number of products. If you run any of these, no further security updates are coming.
| Product | Date | Status |
|---|---|---|
| Windows 11 24H2 Home and Pro | 13 October 2026 | End of servicing; October was the last update |
| Windows 10 Enterprise LTSB 2016 | 13 October 2026 | Final security update |
| Windows Server 2012 and 2012 R2 | 14 October 2026 | Third and final ESU year ends |
| Office 2021, including LTSC | 14 October 2026 | Retired, no ESU for LTSC |
| Exchange Server 2016 and 2019 | 15 October 2026 | ESU coverage ends |
| Windows Server 2022 | 13 October 2026 | Moves to extended support |
| Windows 11 23H2 Enterprise, Education, IoT Enterprise | November 2026 | Updates stop next month |
The Exchange date is the one to watch today, and Rapid7 makes a point worth repeating: future Exchange advisories may simply stop naming 2016 and 2019, which does not mean those versions are unaffected. The consumer side of this was already in train, with Windows 11 24H2 Home and Pro scheduled to stop receiving updates on 13 October.
Has the Update Broken Anything?
No widespread problems have surfaced so far. As of 15 October 2026, neither Microsoft’s published guidance nor the security vendors analysing this release has reported a known issue caused by the October 2026 updates, and no rollback advice has been issued.
That is a change from several recent months, and it removes the usual reason to wait. Microsoft has not said whether the sheer size of the release affected installation times.
Frequently Asked Questions
What Is the Most Urgent Fix in Patch Tuesday October 2026?
CVE-2026-96951, a Windows Shell security feature bypass scored 8.8 that was exploited before the patch shipped. It is the only flaw in the release confirmed as being used in attacks.
How Many Vulnerabilities Did Microsoft Fix?
Published counts range from 1,407 to 1,415, with 1,413 the most frequently cited. The differences come from whether a tally includes flaws published earlier in the month, third-party code and Microsoft Edge.
Does the 16 October Deadline Apply to Me?
Only if you run a United States Federal Civilian Executive Branch agency system, under Binding Operational Directive 26-04. CISA encourages all other organisations to prioritise the same flaw, but sets no deadline for them.
What Does a Mark of the Web Bypass Let an Attacker Do?
It removes the tag Windows puts on files that arrive from the internet, so a downloaded or emailed file opens without the usual warning and without Office Protected View. The user still has to open the file.
Is It Safe to Install This Month’s Update?
As of 15 October 2026 no known issues have been reported for the October 2026 updates, and the exploited Windows Shell flaw is a reason not to delay.
