Microsoft Fixes Record 1,411 Flaws in October 2026 Patch Tuesday
Microsoft's October 2026 Patch Tuesday addresses 1,411 flaws, including 70 Critical bugs and three zero-days, and ends support for two Windows versions.
Microsoft released its October 2026 Patch Tuesday security updates on October 13, 2026, addressing a record 1,411 flaws, according to BleepingComputer. The update includes 70 Critical vulnerabilities, of which 57 are remote code execution flaws, 11 are elevation of privilege issues, and 2 are spoofing vulnerabilities.
Among the patched flaws are three zero-days: one actively exploited and two publicly disclosed. The actively exploited zero-day is tracked as CVE-2026-96951, a Windows Shell security feature bypass that allows bypassing the Mark of the Web. CVE-2026-108398 is a .NET Framework security feature bypass that can bypass Windows Defender Application Control enforcement, and was discovered by James Forshaw of Google Project Zero. A third zero-day, CVE-2026-92707, is a MessagePack-CSharp denial-of-service vulnerability involving improperly controlled sequential memory allocation in .NET.
Microsoft also announced that Windows 11 version 24H2 Home and Pro and Windows 10 Enterprise LTSB 2016 have reached end of support, with the October 2026 update being their final one.
Other vendors released security updates in October 2026. Adobe published fixes for products including Commerce, Substance 3D Samples, ColdFusion, Photoshop, Dimension, and Framework. Atlassian also released security updates or advisories during the month.
Quick answers
How many vulnerabilities did Microsoft fix in the October 2026 Patch Tuesday?
Microsoft addressed a record 1,411 flaws, including 70 Critical vulnerabilities and three zero-days.
Which Windows versions reached end of support in October 2026?
Windows 11 version 24H2 Home and Pro and Windows 10 Enterprise LTSB 2016 reached end of support, with the October 2026 update being their last.
Which zero-day was actively exploited in October 2026?
CVE-2026-96951, a Windows Shell security feature bypass that allows bypassing the Mark of the Web.