October 2026 Patch Tuesday: 1,411 flaws and 3 zero-days

On October 13, Microsoft released fixes for 1,411 flaws and three zero-days, one already exploited. Windows 11 24H2 Home and Pro also stopped receiving patches.

On Tuesday, October 13, 2026, Microsoft released its Patch Tuesday, the monthly security update for Windows and its other products. According to the official data in Microsoft's Security Update Guide, that day it fixed 1,411 flaws (1,408 registered by Microsoft and 3 by GitHub) and three zero-days (vulnerabilities known before a patch is available); 77 of the flaws registered by Microsoft are rated critical.

By type, among those registered by Microsoft, most are elevation of privilege (674) and remote code execution (317), followed by information disclosure (252), denial of service (71), security feature bypass (40), tampering (29) and spoofing (27).

The zero-day that is already being exploited

The most urgent flaw is CVE-2026-96951, in the Windows Shell, with a score of 8.8. It allows bypassing the Mark of the Web, the warning Windows displays when a file comes from the internet. To exploit it, the attacker needs the victim to open a crafted file that arrives by email or instant message, or from a malicious web page. According to CISA's catalog of exploited vulnerabilities, it is the third Windows Shell flaw attacked so far this year.

Other fixes you should not put off

Remote code execution flaws that can be exploited over the network, without credentials and without any user action: 8 in the DHCP server, 4 in NPS and 1 in RD Gateway.
A critical elevation of privilege flaw in SharePoint, CVE-2026-102866 (8.1 out of 10).

The other two zero-days were publicly disclosed before the patch, although no attacks have been reported: CVE-2026-108398, which lets an attacker who already has access to the computer bypass Windows Defender Application Control from .NET Framework, and CVE-2026-92707, a denial of service in the MessagePack-CSharp library. The latter is bundled inside .NET applications as a NuGet package, so it is fixed by updating the package in each application, not through Windows Update.

Microsoft also introduced 15 experimental “risk cohorts” that group related flaws to make prioritization easier; Microsoft notes that they are not official vulnerability categories.

Windows 11 24H2 Home and Pro no longer receives patches

October was the last security update for Windows 11 24H2 in its Home and Pro editions, and for Windows 10 Enterprise LTSB 2016. You need to move to a supported version, such as Windows 11 25H2 or the new 26H2. On November 11, updates also end for Windows 11 23H2 Enterprise and Education.

What to do in your company

Install the October cumulative updates on all computers and prioritize the fix for CVE-2026-96951.
Move computers running Windows 11 24H2 Home or Pro to version 25H2 from Settings > Windows Update.
Update servers running DHCP, RD Gateway or NPS, and SharePoint if you have it installed on your own servers.
Ask your development team to check whether their .NET applications use MessagePack-CSharp.
Remind your staff not to open unexpected attachments or downloads: the zero-day needs someone to open the file.

October 31 update: Microsoft's official figures

We checked this article against Microsoft's official data and corrected some figures we had taken from media outlets: 77 of the flaws registered by Microsoft are critical, not 70, and the remote code execution flaws without user interaction in DHCP, NPS and RD Gateway number 13, not 55. The total of 1,411 flaws does match the official data.

How we help you

With our IT support with preventive maintenance we apply monthly updates in a controlled way, and with the management of your servers we keep the network's critical services up to date.