October 2026 Patch Tuesday: Record 1,400+ Fixes and What to Patch First

Microsoft’s October 2026 Patch Tuesday, released on Oct. 13, fixes more than 1,400 security vulnerabilities in a single month, a record, and one of them is already being used in attacks. If you run Windows at home, open Settings > Windows Update and install the update now. If you run a network, start with the exploited Windows Shell flaw, CVE-2026-96951, then move straight to the critical Active Directory and Exchange Server bugs. Next month’s release lands on Nov. 10, and for Windows 11 Home and Pro version 24H2 there won’t be one.

October 2026 Patch Tuesday: what Microsoft fixed

Tenable counts 1,407 CVEs across 301 products and components, 69 of them rated Critical and 1,337 Important. It calls the release the largest Patch Tuesday on record and notes that October is the second month in a row to set that mark. BleepingComputer’s tally is 1,411, with 70 Critical, and it says its total leaves out 348 flaws Microsoft had already fixed earlier in October. Security firms routinely land a few CVEs apart because they draw the line in different places. Every count agrees on the scale.

Nearly half the fixes (47.9 percent, per Tenable) are elevation-of-privilege bugs, the kind an attacker uses after getting a foothold. Remote code execution makes up 22.3 percent. Microsoft Office Excel had the most CVEs of any single product, 69, followed by the Windows DNS Server role at 52 and the Windows Kernel at 46.

One small experiment rides along this month. Microsoft grouped the fixes into 15 “risk cohorts,” such as 136 flaws in filesystems, storage and backup and 135 in Office documents and mail clients. According to BleepingComputer, Microsoft calls the approach experimental and says the groupings do not signal which flaws are most dangerous. So don’t triage by cohort.

The Windows Shell zero-day, and what to patch first

The bug that matters most is CVE-2026-96951, a Windows Shell security feature bypass with a CVSS score of 8.8. Microsoft rates it Important rather than Critical, but both Tenable and BleepingComputer report that Microsoft lists it as exploited in the wild. It lets an attacker slip past Mark of the Web, the tag Windows puts on downloaded files so that SmartScreen and Office’s Protected View know to warn you. The catch for the attacker: someone has to be persuaded to open a malicious file. Microsoft has not shared how it is being exploited or who found it.

It is the third Windows Shell flaw exploited in the wild this year, Tenable notes, after CVE-2026-21510 in February and CVE-2026-32202 in April.

A second flaw was public before the patch existed. CVE-2026-108398, a .NET Framework bug also scored 8.8, can let an attacker bypass Windows Defender Application Control (WDAC) by getting a malicious .NET assembly loaded into a protected process. BleepingComputer credits its discovery to James Forshaw of Google Project Zero. BleepingComputer also counts a publicly disclosed MessagePack-CSharp denial-of-service bug, CVE-2026-92707, which is why its headline says three zero-days where Tenable says two.

The Exchange RCE is the one to lose sleep over if you still run on-premises mail. Per Tenable, it is reached through a malicious email processed by Exchange’s internal content conversion, which means no one has to click anything. Tenable lists 14 more Important-rated CVEs, scored 7.8 to 8.8, that Microsoft also tags “Exploitation More Likely,” including a BITS remote code execution bug (CVE-2026-88159) and an Exchange privilege escalation (CVE-2026-96940).

KB5127648: the Windows 11 October 2026 update, build by build

For most Windows 11 PCs, the October update is KB5127648. According to Windows Report, it takes version 26H2 to build 26300.9711, 25H2 to 26200.9711 and 24H2 to 26100.9711. Version 23H2 gets KB5126653 (build 22621.7652), the newer 26H1 branch gets KB5127646 (build 28000.3231), and Windows 10 machines enrolled in Extended Security Updates get KB5126657, per BleepingComputer.

To see which you have, press Windows+R, type winver and press Enter. The version and build appear in the second line.

Beyond security, KB5127648 clears up several bugs that have been annoying people since September. Microsoft’s release-health page says it resolves the black screen some users saw when the desktop failed to load, along with an AC-3 audio playback problem in some apps. Windows Report lists the rest:

• Windows Hello fingerprint sign-in failing after a cold boot
• An Always On VPN problem introduced by the September update, KB5124008
• Mouse input stuttering in some games
• File Explorer crashes in multi-user setups such as Azure Virtual Desktop and FSLogix
• A new UTC-05:00 Manitoba time zone, ahead of the province’s Nov. 1 change

If you are on Windows 11 Home or Pro 24H2, this is your last update. Both BleepingComputer and Tenable confirm that 24H2 Home and Pro reached end of servicing on Oct. 13, alongside Office 2021 and the final Extended Security Updates for Windows Server 2012 and 2012 R2. We walked through the upgrade in our guide to the Windows 11 24H2 support deadline.

Known issues: Remote Desktop error 0xC000000D and USB audio

Microsoft’s release-health page still lists two open problems for 25H2, both marked Mitigated rather than fixed.

The first is new. Opened on Oct. 13, it says non-admin users may be unable to connect over Remote Desktop to PCs that have Administrator protection turned on, failing with error 0xC000000D and the message “The token that was passed to the function is invalid.” It traces back to the Sept. 22 preview update, KB5124010. Microsoft’s workaround is for IT admins to “temporarily turn off Administrator protection” by resetting the User Account Control Type Of Admin Approval Mode policy in Intune or Group Policy. That trades a security feature for access, so treat it as a stopgap.

The second affects USB Audio Class 1.0 devices, which can fail with “This device cannot start (Code 10)” or simply produce no sound. An out-of-band update on Sept. 14, KB5129195, fixed the 8-channel and 3D audio symptoms; Microsoft says it is still working on the rest.

Should you install Windows 11 26H2 now?

Microsoft’s release-health page says Windows 11 version 26H2, the Windows 11 2026 Update, is in a phased rollout that “will expand over the next few months,” available now on eligible 24H2 and 25H2 PCs whose owners turned on “Get the latest updates as soon as they’re available” in Windows Update.

Our read: if you are on 24H2 Home or Pro, move now. Staying put means no more security fixes, and the Shell bug above is exactly the type that stops at a patched machine. If you are on 25H2 and everything works, there is no security reason to hurry; you received the same October fixes. Wait for Windows Update to offer 26H2 on its own.

Why is Patch Tuesday so big now?

Microsoft hasn’t said. Two record months in a row invite an obvious question: is AI-assisted bug hunting inflating the count? The circumstantial case exists. Anthropic says partners in its Glasswing program found at least 129,000 verified vulnerabilities between April and July, as we reported in our story on Mythos and the Cyber Verification Program, and Google paused part of its open-source bounty over a flood of mostly invalid automated reports.

There is a duller explanation too. BleepingComputer’s full table includes dozens of third-party CVEs in open-source components Microsoft ships in its Azure Linux distribution (tagged “Mariner”), among them Apache Thrift, Go’s HTTP library and CUPS. Each lands on Microsoft’s list. Neither theory is confirmed, and nobody outside Microsoft can say how many of October’s 1,400-odd fixes were found by machines.

Microsoft wasn’t alone on Oct. 13. BleepingComputer’s roundup of the same period includes an actively exploited Ivanti Connect Secure zero-day, an exploited FortiMail flaw (CVE-2026-104286) and updates from Adobe, SAP and Cisco. More on that beat in our privacy and security coverage.

What to do

• Home users: Settings > Windows Update > Check for updates, install and restart. Run winver afterward and confirm the build ends in .9711 (or .7652 on 23H2).
• Still on 24H2 Home or Pro: upgrade to 25H2 or 26H2 this week.
• IT teams: deploy CVE-2026-96951’s fix first, then domain controllers and Exchange servers. Tell users that a downloaded file opening without its usual warning is no longer a reason to trust it.
• Remote Desktop broken for standard users? Check whether Administrator protection is on before reaching for the policy workaround.

Every exploited bug this month starts with a person opening a file, and that is the one step no update can install.