Microsoft's Record October Patch Tuesday Fixes About 1,400 Flaws, Including an Exploited Windows Zero-Day
BleepingComputer counts 1,411 fixes and 70 critical flaws. One Windows Shell bug that defeats Mark of the Web is being exploited, and counts differ across trackers.
Microsoft's October 2026 Patch Tuesday is the biggest the company has ever shipped. BleepingComputer counts 1,411 security fixes released on the day, 70 of them rated critical, along with a Windows zero-day that attackers are already using.
How many flaws, and who is counting
| Tracker | October 2026 count |
|---|---|
| Tenable / Security Boulevard | 1,407 CVEs (69 critical) |
| Action1 | 1,409 patches (80 critical) |
| BleepingComputer | 1,411 (70 critical), excluding 348 patched earlier in October |
| SecurityWeek, Dark Reading, Malwarebytes | 1,413 |
The totals differ because trackers count differently, so "about 1,400" is the fair summary; Microsoft's Security Update Guide is the authoritative list (SecurityWeek). By type, BleepingComputer lists roughly 677 elevation of privilege flaws, 317 remote code execution, 254 information disclosure, 73 denial of service, 40 security feature bypasses and 28 spoofing bugs. Of its 70 critical flaws, 57 allow remote code execution.
Earlier months were also heavy: about 570 fixes in July, about 400 in August and 966 to 973 in September. October is the largest of the run.
The zero-days
The most urgent is CVE-2026-96951, a Windows Shell security feature bypass that defeats Mark of the Web, the tag Windows attaches to downloaded files so it can warn before you open them. A crafted file sent by email or chat can evade that warning and look like an ordinary local file. It is rated CVSS 8.8 and needs user interaction. Microsoft says it is being exploited, and the US agency CISA added it to its Known Exploited Vulnerabilities catalogue on October 13 with a federal patch deadline of October 16 (CISA). Details of the attacks have not been published; some reports say Microsoft credited researchers from Fujitsu and Anthropic, among others, for finding it.
Two more flaws were publicly disclosed before patches arrived, with no exploitation confirmed. CVE-2026-108398 is a .NET Framework bypass that could let an attacker run unauthorised code past Windows Defender Application Control, found by James Forshaw of Google Project Zero. CVE-2026-92707 is a denial of service flaw in MessagePack-CSharp, a library developers build into their own .NET apps, so fixing it means updating the package and rebuilding software, not just installing a Windows update. Some outlets count two zero-days rather than three.
Outlook and other fixes
Secondary reports point to five critical remote code execution flaws in Outlook, some said to be reachable through the reading pane; administrators should check Microsoft's advisories before reprioritising. The release also fixes a critical Linux kernel flaw (CVE-2026-62840), .NET, ASP.NET Core, Active Directory Federation Services, Azure services and Dynamics Business Central, plus non-Microsoft components in its Mariner distribution such as GnuTLS, CUPS and Go's net/http.
What to install
| Windows version | Update |
|---|---|
| Windows 11 | KB5127648, KB5126653 |
| Windows 10 (Extended Security Updates only) | KB5126657 |
Most home PCs get the fixes automatically through Windows Update (Malwarebytes). Windows 10 PCs outside the ESU programme do not receive the zero-day fix, a real risk for the many older Windows 10 machines still in use in Indian homes and small offices. Administrators should patch the Mark of the Web flaw first on exposed systems, then the .NET bypass wherever application control is used, then MessagePack-CSharp in internal software. Note that KB5127648 has a known issue that can stop you turning on Smart App Control.
Support endings
Windows 11 version 24H2 Home and Pro and Windows 10 Enterprise LTSB 2016 have received their final updates. Windows 11 23H2 Enterprise, Education and IoT Enterprise stop receiving security updates on November 10.
What to watch next
A reconciled count from Microsoft, details of how CVE-2026-96951 is being exploited, and the November 10 deadline for Windows 11 23H2 editions.
