Microsoft’s October 2026 Patch Tuesday has arrived with a record-breaking haul: security updates fixing 1,411 flaws, including one actively exploited zero-day and two publicly disclosed zero-days. The release covers 70 vulnerabilities rated “Critical,” with 57 of those enabling remote code execution, 11 allowing elevation of privilege, and 2 tied to spoofing. Microsoft says it’s increasingly relying on artificial intelligence platforms to find and fix security bugs in its products, which may help explain the record count this month.
What are the Patch Tuesday October 2026 zero-days?
The actively exploited bug fixed this Patch Tuesday October 2026 is CVE-2026-96951, a Windows Shell security feature bypass that let attackers slip past the Mark of the Web protection through command injection over a network. Microsoft hasn’t disclosed how it was exploited in the wild or who reported it.
The two publicly disclosed zero-days are CVE-2026-108398, a .NET Framework flaw that could let an authenticated attacker bypass Windows Defender Application Control by registering a malicious .NET assembly for loading by a protected process — no user interaction required — and CVE-2026-92707, a denial-of-service issue in MessagePack-CSharp caused by improperly controlled memory allocation in .NET. Security teams juggling patches like this should also note the pattern described in CISA Warns of Critical Gitea Vulnerability Exploited in Code Injection Attacks, another case where attackers moved fast on a disclosed flaw before defenders could fully respond.
End of support and other changes this Patch Tuesday October 2026
Alongside the fixes, Microsoft confirmed that Windows 11 version 24H2 Home and Pro, and Windows 10 Enterprise LTSB 2016, reached end of support on October 13, 2026 — meaning this month’s update is the last one these editions will receive. Microsoft also reminded organizations running Windows 11 23H2 Enterprise, Education, and IoT Enterprise that they’ll stop getting security updates starting next month and should upgrade soon.
For U.S. businesses and IT teams, the takeaway is simple: apply this update promptly, especially given the actively exploited flaw, and check whether any machines are still running the now-unsupported editions. As with other recent threats, including the credential-hijacking scheme detailed in NovaCookies Phishing Toolkit Exploits DocuSign to Hijack Microsoft 365 Sessions, staying current on patches remains one of the simplest ways to reduce exposure.
المصدر: BleepingComputer
