Reported by 8 outlets
Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days
Why this score
- Breadth
- 2.00 / 2.0 · 8 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 2.00 / 2.0 · updates in 48h
- Pickup speed
- 0.38 / 0.6 · time to second source
- Recency
- × 0.97 temporal multiplier
- Community
- + 0.40 / 1.5 · reddit signal
- Score
- 10.0 / 10 = base × recency + community
Desk analysis
Microsoft's October 2026 Patch Tuesday fixes 1,411 flaws, including CVE-2026-96951, a security feature bypass in Windows Shell already exploited in the wild. The batch dwarfs September's record of nearly 1,000 fixes; at least 78 flaws are rated critical and allow remote code execution. CVE-2026-108398 (.NET Framework security feature bypass) was publicly disclosed ahead of the patch, giving attackers advance notice. Microsoft also quietly extended Windows 10 free updates until October 2027. The scale makes prioritization difficult; defenders should focus on the actively exploited zero-day and the publicly known .NET bypass first.
Timeline
-
original reporting
Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days
bleepingcomputer.com · 8h ago · October 13th, 2026
Today is Microsoft's October 2026 Patch Tuesday, with security updates addressing a record-breaking 1,411 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities. This Patch Tuesday addresses 70 "Critical" vulnerabilities, 57 of which are remote code execution, 11 are elevation of privileges, and 2 are spoofing. The approximate number of bugs in each vulnerability category is listed below: When BleepingComputer reports on Patch Tuesday security updates, we only count vulnerabilities released by Microsoft on Patch Tuesday itself. Therefore, today's total excludes 348 flaws fixed earlier this month, including vulnerabilities in Azure API Center, Azure App Service, Azure Event Grid, Azure SRE Agent, Mariner, Microsoft Bookings, Microsoft Dataverse, Microsoft Exchange Server, and Microsoft Partner Center. This is a record-breaking Microsoft Patch Tuesday as Microsoft continues to use artificial intelligence platforms to find and remediate security vulnerabilities in its products. Microsoft announced today that Windows 11, version 24H2 Home and Pro, and Windows 10 Enterprise LTSB 2016 have reached end of support . "Today, October 13, 2026, Windows 11, version 24H2 Home and Pro , and Windows 10 Enterprise LTSB 2016 have reached end of updates. The October 2026 monthly security update is the last update available for these editions," Microsoft said. Earlier this month, Microsoft also said organizations running Windows 11 23H2 Enterprise, Education
-
update from msrc.microsoft.com
October 2026 Security Updates
msrc.microsoft.com · 21h ago · October 13th, 2026
Microsoft's Security Response Center published the October 2026 Security Updates CVRF advisory at 07:00 UTC on 2026-10-13, roughly ten hours before the story's first news pickup at 17:49 UTC. The document covers 1,759 CVEs, matching the 1,411 Patch Tuesday fixes plus the 348 released earlier in the month. In it, CVE-2026-96951 (Windows Shell Security Feature Bypass) is marked Exploited: Yes with exploitation detected and no prior public disclosure, and the release ships no workarounds. The same advisory marks CVE-2026-108398 (.NET Framework Security Feature Bypass) as publicly disclosed, crediting James Forshaw with Google Project Zero.
-
update from bleepingcomputer.com
Windows 11 KB5127648 & KB5126653 cumulative updates released
bleepingcomputer.com · 10h ago · October 13th, 2026
Microsoft has released Windows 11 KB527648 and KB5126653 cumulative updates for versions 26H2/25H2/24H2 and 23H2 to fix security vulnerabilities and bugs and add new features. Today's updates are mandatory as they contain the October 2026 Patch Tuesday security patches for hundreds of vulnerabilities discovered in previous months. You can install today's update by going to Start > Settings > Windows Update and clicking on 'Check for Updates .' You can also manually download and install the update from the Microsoft Update Catalog . There are no exclusive or special changes. With today's update, Microsoft is adding new emojis to Windows 11 and fixing minor issues with File Explorer. Here's the full list of improvements and fixes: New! This update adjusts how the preview pane handles files downloaded from the web. For HTML files, a new Preview anyway button lets you acknowledge the warning and preview the file. Non-HTML files, such as PDFs, are now previewed automatically. File Explorer Home now preserves the state of sections (expanded or collapsed), so you can pick up where you left off. This update improves the reliability of thumbnail previews for cloud files in the Details pane. The pane has also been reorganized so file properties are easier to find and review at a glance.
-
mentioned by msrc.microsoft.com
Microsoft Patch Tuesday with an exploited zero-day: CVE-2026-96951 (8.8 high) Windows Shell Security Feature Bypass Vulnerability https:// m
msrc.microsoft.com · 9h ago · October 13th, 2026
-
update from malware.news
October 2026 Microsoft Patch Tuesday, (Tue, Oct 13th)
malware.news · 8h ago · October 13th, 2026
76 of these vulnerabilities are rated critical, with 7 critical vulnerabiilties requiring no customer actions. Article Link: October 2026 Microsoft Patch Tuesday - SANS ISC
-
update from msrc.microsoft.com
two of my findings are in today's Microsoft Patch Tuesday. CVE-2026-88156, Outlook RCE, 9.8 critical. stack-based buffer overflow, no click
msrc.microsoft.com · 8h ago · October 13th, 2026
CVE-2026-88156, Outlook RCE, 9.8 critical. stack-based buffer overflow, no click
via Mastodon https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88156
-
update from bleepingcomputer.com
Microsoft releases Windows 10 KB5126657 extended security update
bleepingcomputer.com · 8h ago · October 13th, 2026
If you are running Windows 10 Enterprise LTSC or are enrolled in the ESU program , you can install this update like normal by going into Settings, clicking on Windows Update, and manually performing a 'Check for Updates.' After installing this update, Windows 10 will be updated to build 19045.7807, and Windows 10 Enterprise LTSC 2021 will be updated to build 19044.7807. Microsoft no longer releases new features for Windows 10, and the KB5126657 update mainly includes security updates and bug fixes. The complete list of fixes and changes in KB5126657 is listed below: Microsoft says the update has a known issue affecting some USB Audio Class 1.0 devices after installing the September 2026 Windows security updates. Affected devices may fail to start with a Code 10 error in Device Manager, stop producing audio, or experience unresponsive volume controls and sound settings. Some devices may also work in standard stereo mode but fail when using 8-channel or 3D audio configurations. Microsoft partially fixed the issue in an emergency out-of-band update released on September 14, which ad
-
mentioned by www.thezdi.com
(thezdi.com) October Patch Tuesday: Record-Breaking Volume of CVEs and Critical Vulnerabilities in Microsoft and Adobe Products In brief - T
www.thezdi.com · 7h ago · October 13th, 2026
-
mentioned by www.bleepingcomputer.com
🤖 Microsoft October 2026 Patch Tuesday fixes a record 1,411 flaws, including 1 zero-day exploited in the wild and 2 publicly disclosed. Wind
www.bleepingcomputer.com · 7h ago · October 13th, 2026
-
update from malware.news
Microsoft security advisory – October 2026 monthly rollup (AV26-1038)
malware.news · 7h ago · October 13th, 2026
Serial Number: AV26-1038 Date: October 13, 2026 As of October 13, 2026, Microsoft is affected by vulnerabilities in the following products: .NET 10.0 .NET 11.0 .NET 8.0 .NET 9.0 ASP.NET Core 10.0 ASP.NET Core 11.0 ASP.NET Core 8.0 ASP.NET Core 9.0 Arc Enabled Servers Azure API Center Azure App Service for Linux Azure CLI Azure CycleCloud Azure Container Storage enabled by Azure Arc Azure Event Grid System Azure SRE Agent Azure Storage Blobs client library for Java HVEC Video Extensions Microsoft .NET Framework 3.5 AND 4.8.1 Microsoft .NET Framework 4.8.1 Microsoft 365 Apps for Enterprise Microsoft Bookings Microsoft Configuration Manager 2503 Microsoft Configuration Manager 2509 Microsoft Configuration Manager 2603 Microsoft Defender for Endpoint Microsoft Dataverse Microsoft Dynamics 365 (on-premises) version 9.1 Microsoft Dynamics NAV 2017 Microsoft Dynamics NAV 2018 Microsoft Exchange Server 2016 Microsoft Exchange Server 2019 Microsoft Exchange Server Subscription Edition RTM Microsoft Office 365 Microsoft Office LTSC 2021 Microsoft Office LTSC 2024 Microsoft Office Online Server Microsoft Outlook Microsoft Paint Microsoft Partner Center Microsoft Power Apps Microsoft PowerToys Microsoft SQL Server
-
update from rapid7.com
Patch Tuesday - October 2026
rapid7.com · 6h ago · October 13th, 2026
Microsoft is publishing 1,413 own-product vulnerabilities on October 2026 Patch Tuesday , including 1,102 vulnerabilities in Windows. Anyone who enjoyed last month’s record-setting Patch Tuesday will love the October 2026 edition, because it’s much bigger still. As Rapid7 has noted over the course of 2026, there is every reason to suppose that vulnerability volumes will continue to rise. Microsoft is aware of exploitation in the wild for just one of the vulnerabilities published today, as well as public disclosure for two others. Windows Shell: zero-day security feature bypass The Windows Shell is Microsoft’s term for the GUI interaction logic for the entire OS provided by explorer.exe and associated libraries and APIs, and for the second time this year , the Windows Shell is the site of an exploited-in-the-wild zero-day vulnerability. Once again, the immediate prize for an attacker is a Mark of the Web (MOTW) bypass. What this means is that Windows won’t provide the user with a dialog explaining that Windows protected their PC, because in this case, it didn’t. Exploitation requires that a user opens a specially crafted malicious file or visits an attacker-controlled site, so the evergreen advice about being careful what you click remains valid. Fans of vintage operating systems should note that Windows Server 2012 doesn’t receive a patch, although Server 2012 R2 does. The advisory acknowledges reporters from multiple organizations, althou
-
update from tenable.com
Microsoft’s October 2026 Patch Tuesday addresses 1407 CVEs (CVE-2026-96951)
tenable.com · 6h ago · October 13th, 2026
69 Critical 1337 Important 0 Moderate 1 Low Microsoft addresses 1407 CVEs in the tenth Patch Tuesday of 2026, marking the second consecutive month to reset the bar as the largest Patch Tuesday release. The following table lists the products with the most CVEs patched this month. Rank Product CVE Count 1 Microsoft Office Excel 69 2 Role: DNS Server 52 3 Windows Kernel 46 4 Windows Installer 38 5 Windows Win32 Kernel Subsystem 36 6 Microsoft Office SharePoint 34 7 Microsoft Windows Search Component 29 8 Windows NTFS 26 9 .NET 25 10 (Tie) Microsoft Office Word 22 10 (Tie) SQL Server 22 10 (Tie) Windows Error Reporting 22 Elevation of Privilege (EoP) vulnerabilities accounted for 47.9% of the vulnerabilities patched this month, followed by remote code execution (RCE) vulnerabilities at 22.3%. It received a CVSSv3 score of 8.8 and was rated as important.
-
update from malware.news
Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities
malware.news · 5h ago · October 13th, 2026
The shared weakness is Improper Neutralization of Special Elements used in a Command (‘Command Injection’). The vulnerability has a CVSS base score of 8.8. Microsoft considers exploitation of the following vulnerabilities more likely. CVE-2026-70229 is a remote code execution vulnerability that affects Windows Active Directory Domain Services. The shared weakness is Incorrect Authorization. CVE-2026-105733 , CVE-2026-102214 , and CVE-2026-108399 affect Windows Hyper-V.
-
mentioned by ninjasignal.ninja
🚨 NEW on CISA KEV — exploited in the wild 🛡 Microsoft Windows Microsoft Windows Command Injection Vulnerability CVE: CVE-2026-96951 · patch
ninjasignal.ninja · 4h ago · October 13th, 2026
-
update from krebsonsecurity.com
Microsoft Patches More Than 1,400 Security Flaws
krebsonsecurity.com · 4h ago · October 13th, 2026
Today’s epic patch batch dwarfs September’s record of nearly 1,000 fixes, which was already about ten times the normal monthly patch load from Redmond. Windows 10 users might be wondering if they can still expect security updates after this month. Microsoft had been slated to stop shipping updates for Windows 10 systems in October 2025, but ended up adding another year of free updates after considerable pushback. A few months ago, Microsoft quietly extended that support for another year (until October 2027). At least 78 of the flaws fixed this month are rated “critical,” meaning they could be exploited with little or no action by the user, and most of those critical bugs allow an attacker to execute code of their choice on the vulnerable system. Satnam Narang at Tenable said the number of flaws fixed this month far surpasses the previous record-setting year
-
update from malware.news
Microsoft Patches More Than 1,400 Security Flaws
malware.news · 4h ago · October 13th, 2026
While Microsoft said there are no signs anyone is exploiting it yet, a security feature
-
update from krebsonsecurity.com
Microsoft Patches More Than 1,400 Security Flaws https:// krebsonsecurity.com/2026/10/mi crosoft-patches-more-than-1400-security-flaws/ # Pa
krebsonsecurity.com · 4h ago · October 14th, 2026
Microsoft Patches More Than 1,400 Security Flaws https:// krebsonsecurity.com/2026/10/mi crosoft-patches-more-than-1400-security-flaws/ # Pa
via Mastodon https://krebsonsecurity.com/2026/10/microsoft-patches-more-than-1400-security-flaws/
-
mentioned by krebsonsecurity.com
"Microsoft today issued updates to fix more than 1,400 security vulnerabilities in Windows and other software. Today’s epic patch batch dwar
krebsonsecurity.com · 4h ago · October 14th, 2026
-
mentioned by malware.news
October 2026 Patch Tuesday: 1,413 CVEs Include Three Zero-Days and 75 Critical Vulnerabilities
malware.news · 2h ago · October 14th, 2026
-
mentioned by krebsonsecurity.com
Microsoft just released a massive update to fix over 1,400 security flaws in its software. To keep your computer safe and protected from pot
krebsonsecurity.com · 1h ago · October 14th, 2026
-
mentioned by malware.news
Security Alert: Microsoft Releases October 2026 Security Updates
malware.news · 1h ago · October 14th, 2026