Microsoft October 2026 Patch Tuesday fixes 1,411 flaws
Microsoft's October 2026 Patch Tuesday security updates address a record-breaking 1,411 flaws, including three zero-day vulnerabilities, alongside new end-of-support deadlines and priority grouping strategies.
Radwan AbdulhadiEditor and technology writer
Record-Breaking Patch Tuesday Volume
Today marks Microsoft's October 2026 Patch Tuesday, with security updates addressing a record-breaking 1,411 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities, according to BleepingComputer reports by Lawrence Abrams.
This massive release addresses 70 Critical vulnerabilities, broken down into 57 remote code execution flaws, 11 elevation of privilege issues, and two spoofing vulnerabilities.
When BleepingComputer reports on Patch Tuesday security updates, editors only count vulnerabilities released by Microsoft on Patch Tuesday itself. Therefore, today's total excludes 348 flaws fixed earlier in the month across platforms like Azure API Center, Azure App Service, Azure Event Grid, Azure SRE Agent, Mariner, Microsoft Bookings, Microsoft Dataverse, Microsoft Exchange Server, and Microsoft Partner Center.
This record-breaking volume arrives as Microsoft continues to use artificial intelligence platforms to find and remediate security vulnerabilities in its software ecosystem.
Zero-Day Vulnerabilities Addressed
The October 2026 update fixes three zero-day vulnerabilities, which Microsoft classifies as flaws that are either publicly disclosed or actively exploited when no official fix is available.
The actively exploited zero-day vulnerability fixed this month is CVE-2026-96951 - Windows Shell Security Feature Bypass Vulnerability.
Microsoft patched this actively exploited security bypass flaw that allowed unauthorized attackers to bypass the Mark of the Web security feature via command injection in the Windows Shell over a network.
In addition, two other zero-day flaws were publicly disclosed: CVE-2026-108398 in the .NET Framework, discovered by James Forshaw of Google Project Zero, which allowed attackers to bypass Windows Defender Application Control enforcement; and CVE-2026-92707, a denial-of-service vulnerability in MessagePack-CSharp.
Operating System Lifecycles and Updates
Alongside the security fixes, Microsoft announced that specific operating system versions have reached end of support.
Windows 11 version 24H2 Home and Pro, along with Windows 10 Enterprise LTSB 2016, have reached end of support, meaning today's monthly security update is the final release available for these editions.
Earlier in the month, Microsoft also noted that organizations running Windows 11 23H2 Enterprise, Education, and IoT Enterprise editions must upgrade, as they will no longer receive security updates starting next month.
Users looking for non-security updates can review dedicated documentation covering the Windows 11 KB5127648 & KB5126653 cumulative updates and the Windows 10 KB5126657 extended security update.
New Risk Cohorts for Prioritization
To help organizations manage this record-breaking number of vulnerabilities, Microsoft introduced a new categorization method called risk cohorts.
This approach groups similar vulnerabilities together to help security teams understand which flaws pose the greatest risk to their systems.
For October 2026, Microsoft published 15 distinct risk cohorts, including 136 vulnerabilities affecting Windows filesystems, storage, and backup; 135 vulnerabilities involving Office documents and mail clients; and 131 vulnerabilities affecting Windows graphics, media, and content processing.
Advisories from Other Vendors
Numerous other major technology vendors also released security updates and advisories during October 2026 alongside Microsoft's patch cycle.
Vendors publishing updates included Adobe, Atlassian, Cisco, Citrix, Dell, Docker, Fortinet, GitLab, Ivanti, Kiteworks, Progress Software, SAP, and SonicWall, many of which addressed critical remote code execution and zero-day vulnerabilities in their respective enterprise and cloud products.
Sources
- BleepingComputerMicrosoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days
Continue chronologically
Related entity coverage
Related stories
Microsoft Patches Record 1,413 Vulnerabilities in October
Microsoft's October 2026 Patch Tuesday fixes a record 1,413 vulnerabilities, including an actively exploited Windows zero-day flaw.
Citrix, Fortinet, and Ivanti Patch 29 Security Vulnerabilities
Citrix, Fortinet, and Ivanti release vital security updates addressing 29 vulnerabilities, including critical execution and zero-day flaws.
Microsoft and Adobe Barred From US Residency Sponsorship
The US administration has temporarily blocked Microsoft, Adobe, and several IT outsourcing firms from sponsoring foreign workers for residency.
US Suspends Residency Program for Microsoft and Adobe
The US government suspends a permanent residency program for Microsoft, Adobe, and five other tech companies amid H-1B visa fraud allegations.
