Patch Tuesday October 2026: Microsoft's Biggest Update Ever

Microsoft shipped its largest Patch Tuesday on record on October 13, 2026, addressing more than 1,400 CVEs across Windows, Office, .NET, Exchange, Azure and other products, with roughly 70 rated Critical. One of the flaws, CVE-2026-96951, a Windows Shell security-feature bypass, is already being exploited in the wild: the Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities (KEV) catalog the same day and gave federal agencies until October 16, 2026 to remediate it. Two other publicly disclosed flaws, one in .NET Framework and one in the open-source MessagePack-CSharp library, were patched without evidence of active exploitation. If you run Windows, the short version is: install the October cumulative update, KB5127648, now, and if you're still on Windows 11 24H2 Home or Pro, know that this is the last security update that edition will ever receive.

What happened: a record-setting Patch Tuesday

Microsoft's October 2026 Patch Tuesday landed on October 13, the second Tuesday of the month, and it is being described by security teams tracking the release as the single largest batch of fixes Microsoft has ever shipped in one monthly cycle. Published counts of the exact number of CVEs vary depending on how each tracker tallies Microsoft's Security Update Guide — figures reported elsewhere range from roughly 1,407 to 1,415 — but every count puts the release at more than 1,400 vulnerabilities addressed, comfortably Microsoft's biggest Patch Tuesday to date. Severity breakdowns differ slightly by source as well, with Critical-rated counts cited anywhere from the high 60s to around 80; this article uses "roughly 70 Critical" as the representative figure, consistent with Microsoft's own Security Update Guide severity tags for the month's highest-profile advisories.

The release touches nearly every actively supported Microsoft product line: Windows client and server, Microsoft Office, SharePoint, Exchange Server, .NET and .NET Framework, Visual Studio, SQL Server, Dynamics and Azure services. Nine of the thirteen product families Microsoft groups its October advisories under carry a maximum severity rating of Critical, underscoring how broad this month's exposure is rather than how it's concentrated in a single product.

Only one of the month's vulnerabilities has a confirmed record of exploitation before the patch shipped. That distinguishes it sharply from the rest of the list, and it's the reason every Windows admin should treat this month's update as urgent rather than routine, even with a patch count this large to work through.

The exploited zero-day: CVE-2026-96951

CVE-2026-96951 is a security-feature bypass in Windows Shell, documented in Microsoft's Security Update Guide advisory for the flaw. According to CISA's Known Exploited Vulnerabilities catalog entry, the flaw lets an unauthorized attacker bypass a security feature over a network; the practical effect described by Microsoft and repeated in CISA's listing is that it allows an attacker to get around the Mark-of-the-Web (MotW) protection Windows normally applies to files downloaded from the internet or received by email. MotW is the mechanism that triggers Windows' "this file came from the internet" warnings and SmartScreen checks before a downloaded document, script or executable is allowed to run unprompted. A successful bypass means a specially crafted file can skip those warnings, making it easier for a phishing attachment or drive-by download to execute without the usual friction that's supposed to make a victim pause.

CISA added CVE-2026-96951 to the KEV catalog on October 13, 2026 — the same day Microsoft published the fix — and set a remediation due date of October 16, 2026, a three-day window. Under Binding Operational Directive 26-04, that short deadline applies to U.S. federal civilian agencies, but CISA's guidance has always been that every organization, not just federal ones, should treat KEV entries as a prioritized patch list. Microsoft has not publicly detailed who is exploiting the flaw or in what campaigns; both Microsoft's own advisory and CISA's catalog entry describe it only as a security-feature bypass with confirmed exploitation, without attributing it to a specific actor.

This is the second straight month a Windows zero-day has made the KEV catalog in a Patch Tuesday release — Pandromeda covered two actively exploited Windows zero-days in September's Patch Tuesday — a reminder that attackers continue to find and weaponize Windows flaws faster than enterprises can patch them.

Other notable flaws: publicly disclosed, not yet exploited

Two other vulnerabilities in October's batch were publicly disclosed ahead of or alongside the patch but, unlike CVE-2026-96951, are not currently known to have been exploited.

CVE-2026-108398, detailed in Microsoft's advisory for the flaw, is a security-feature bypass in .NET Framework. It was reported to Microsoft by James Forshaw of Google's Project Zero team, and it lets an attacker bypass Windows Defender Application Control (WDAC), the mechanism organizations use to restrict which applications and binaries are allowed to run on a locked-down machine. Getting around WDAC doesn't hand an attacker code execution by itself, but it removes a control that's specifically meant to stop unauthorized code from running, which matters a great deal to organizations that rely on WDAC as a core defense in locked-down or kiosk-style environments.

CVE-2026-92707, also tracked in Microsoft's Security Update Guide, affects MessagePack-CSharp, an open-source serialization library used in a range of .NET applications to encode and decode MessagePack binary data. It's a denial-of-service issue: an attacker who can send crafted MessagePack payloads to an application that deserializes untrusted input can exhaust memory or otherwise degrade availability, rather than gain code execution or access data. Applications most exposed are the ones that accept MessagePack-encoded data at a public boundary, such as REST APIs, WebSocket handlers or message-queue consumers.

Is my PC at risk?

If you're running a supported version of Windows 10 or Windows 11 and haven't installed the October 2026 cumulative update, you're exposed to CVE-2026-96951 and whichever of the other 1,400-plus fixes apply to the software you run. The Mark-of-the-Web bypass is particularly relevant to anyone who regularly opens files received by email or downloaded from the web — which, practically, is everyone — because MotW is one of the last checkpoints standing between a malicious attachment and execution.

The WDAC bypass (CVE-2026-108398) matters most to organizations that actively enforce Windows Defender Application Control as part of a locked-down endpoint configuration; home users who don't use WDAC aren't directly exposed to that specific bypass, though they should still patch .NET Framework as part of the full update. The MessagePack-CSharp denial-of-service issue (CVE-2026-92707) is relevant mainly to developers and organizations running .NET applications or services that deserialize MessagePack data from external or untrusted sources — consumer Windows PCs running no such service aren't meaningfully exposed.

Enterprises managing patching for Exchange or other Microsoft server products separately should also check Pandromeda's recent coverage of the actively discussed Exchange vulnerability, CVE-2026-96940, which is being patched on its own track outside this month's Windows cumulative update.

How to update Windows now

For most Windows 11 users, the relevant update is KB5127648, covering OS builds 26300.9711 (version 26H2), 26200.9711 (version 25H2) and 26100.9711 (version 24H2), serviced alongside the servicing-stack update KB5127647. To install it:

1. Go to Settings > Windows Update and select Check for updates.
2. Install the October 2026 cumulative update when it appears, then restart when prompted.
3. If the update doesn't appear automatically, it can be downloaded directly from the Microsoft Update Catalog or installed via the official KB5127648 support article, which lists manual download links for each supported build.
4. Enterprises managing updates via WSUS, Configuration Manager or Intune should approve and deploy KB5127648 on an accelerated timeline given the active exploitation of CVE-2026-96951, rather than waiting for a standard patch-ring rollout.

Windows Server administrators and users of older supported Windows 10 builds should check Microsoft's Security Update Guide for the equivalent KB for their specific version; the build numbers and KB identifiers differ by release even though the underlying fixes, including the CVE-2026-96951 patch, are shipped across all supported versions.

Known issues with this update

Microsoft's support documentation for KB5127648 lists two known issues worth flagging before a broad rollout:

• Remote Desktop sign-in failures for non-admins. On devices with Administrator protection enabled, non-administrator users may be unable to connect to a remote device and may see error code 0xC000000D. Microsoft says IT administrators can temporarily work around this by disabling Administrator protection via policy while a permanent fix is developed; no fix had shipped as of the update's release.
• Some USB Audio Class 1.0 devices failing to produce sound. This issue was first introduced by an earlier update; Microsoft's out-of-band update KB5129195, released in September 2026, resolved the 8-channel and 3D audio symptoms, but some USB Audio Class 1.0 devices may still fail to start or produce no sound under other conditions. Affected business customers are directed to contact Microsoft Support for further help.

Beyond the known issues, KB5127648 also delivers a batch of non-security fixes: it addresses Windows Explorer crashes and black screens in multi-user scenarios such as Azure Virtual Desktop and FSLogix environments, fixes AC-3 audio playback failures in some applications, resolves Always On VPN connections getting stuck in a "Connecting" state after an earlier update, fixes Storage Spaces Direct tiered virtual disks that failed to come online, adds a new UTC-05:00 Manitoba time zone ahead of that province's November 1, 2026 change, extends ReFS auditing and policy controls to externally attached storage, fixes printing failures tied to RAW and Generic Text Only drivers introduced by the August 2026 update, resolves mouse stutter in some games, and fixes fingerprint sign-in failures that occurred after a cold boot on some devices.

End of the road for Windows 11 24H2 Home and Pro

Buried in the KB5127648 release notes is a significant lifecycle milestone: this is the last security update Windows 11, version 24H2 Home and Pro editions will ever receive. Microsoft's support documentation confirms that 24H2 Home and Pro have reached end of servicing, and devices still running that edition will no longer get monthly security or preview updates going forward. Microsoft's stated recommendation is straightforward: move to a currently serviced version of Windows 11, such as 25H2 or 26H2, to keep receiving security patches.

Anyone still deciding how to handle an in-place Windows 11 feature-update rollout should also review Pandromeda's rundown of Windows 11 26H2's confirmed known issues before moving a fleet of machines onto the newer release, since some of 26H2's own rough edges are still being resolved separately from this month's security content.

What next: the patching checklist

Given the scale of this release and the fact that one flaw is already under active attack, the practical priorities are straightforward:

1. Patch CVE-2026-96951 first. It's on CISA's KEV catalog with an October 16, 2026 due date for federal agencies, and every other organization should treat that same deadline as the practical benchmark for its own environment.
2. Install KB5127648 across all supported Windows 10 and Windows 11 fleets, checking the known issues around Remote Desktop and USB Audio Class 1.0 devices before a wide rollout, particularly on environments using Administrator protection.
3. Check whether WDAC-enforced environments need extra attention for CVE-2026-108398, and confirm which internal or third-party .NET applications deserialize MessagePack data before assuming CVE-2026-92707 doesn't apply.
4. If you're still on Windows 11 24H2 Home or Pro, start planning your move to a currently serviced version now that this month's update is the edition's last.
5. Don't let the record-setting total distract from triage. Patch management teams working through more than 1,400 individual advisories should prioritize anything rated Critical or flagged as exploited, rather than trying to review every entry with equal urgency in the same cycle.

Pandromeda will continue to track Microsoft's Security Update Guide and CISA's KEV catalog for any changes to exploitation status or additional guidance as the month progresses.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage