Patch Tuesday October 2026: 1,407 Vulnerabilities Fixed, Including Three Zero-Days

After patching 973 vulnerabilities in September, Microsoft has reached a new milestone: the October 2026 Patch Tuesday fixes 1,407 vulnerabilities. One zero-day is already being exploited, and several versions of Windows, Windows Server, and Exchange are receiving their final updates. Here’s what you need to know.

On Tuesday, October 13, 2026, Microsoft released its monthly batch of security fixes. Last month, I said that the September 2026 Patch Tuesday and its 973 vulnerabilities were by far the largest in history. That record lasted only one month. It has been shattered. This month, Microsoft patched 1,407 vulnerabilities, more than 400 more than in September.

This is not entirely surprising, even if one wonders how far it will go: Microsoft is using AI to search for vulnerabilities in its products. The number of patches has only continued to rise in recent months. The Windows operating system alone is affected by 1,115 vulnerabilities, followed by the Microsoft Office suite (138), SharePoint Server (36), SQL Server (22), and Exchange Server (6). Among these flaws, 672 could allow privilege escalation and 314 remote code execution, including 69 vulnerabilities considered critical.

Faced with this volume of issues, Microsoft has decided to test a new method to help IT teams prioritize deployments: risk cohorts. The idea is to group CVEs whose priority depends on the same factor in your environment, for example the exposure of your RDP servers. If you want to learn more, I invite you to read my article dedicated to this new approach.

Let’s continue with this month’s Patch Tuesday. Among the vulnerabilities that deserve special attention, here are the key ones:

• Active Directory (CVE-2026-70229) : a critical remote code execution flaw in Active Directory domain services, with no authentication or interaction required. An attacker only needs to send a specially crafted packet to an affected service. "In practice, an attacker cannot reliably exploit the issue in all environments, as a successful attack may require favorable configuration or circumstances.", Microsoft says.
• Outlook (5 CVEs) : CVE-2026-70242, CVE-2026-97749, CVE-2026-97016, CVE-2026-88156 and CVE-2026-70291 are five remote code execution flaws rated 9.8 out of 10. Simply displaying a malicious email in the reading pane is enough, so the user does not need to open the message or click anything.
• DHCP Server (CVE-2026-96934) : a use-after-free flaw rated 9.8 out of 10, remotely exploitable by an unauthenticated attacker using a specially crafted packet.
• Exchange Server (CVE-2026-70571) : a specially crafted email triggers an internal content conversion process on the server, allowing code execution. No authentication is required, but the attacker must have an in-depth understanding of the targeted environment. Exchange SE, 2019, and 2016 are affected.
• SharePoint Server (CVE-2026-102866) : an unauthenticated attacker who obtains a valid proof token from a user can modify it to authenticate as that user. Only the Subscription Edition is listed.

Three zero-days, including one already exploited

This month, Microsoft fixed three zero-day security flaws: one is already being exploited, while the other two were disclosed before the patch was made available.

CVE-2026-96951 - Windows Shell

Associated with a CVSS score of 8.8 out of 10, CVE-2026-96951 is a command injection issue in Windows Shell that bypasses Mark of the Web (MOTW) protection. As a reminder, this is the marker Windows applies to files downloaded from the Internet and which triggers SmartScreen warnings, among other things.

"In the case of an email or instant messaging attack, the attacker could send the targeted user a specially crafted file designed to exploit the vulnerability.", Microsoft says. User action is still required: opening an attachment or clicking a link. However, Microsoft provides no details about the attacks observed.

This flaw affects many Microsoft operating systems, including Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 R2 through 2025.

CVE-2026-108398 - .NET Framework

This security flaw (CVSS 8.8) allows bypassing Windows Defender Application Control (WDAC), now called App Control for Business.

"An authenticated attacker could place a specially crafted .NET assembly on an affected system and register it to be loaded by a protected process. Successful exploitation could bypass Windows Defender Application Control restrictions and allow the attacker to execute code in the protected process.", Microsoft explains. In other words, the attacker must already have local access.

To protect yourself against CVE-2026-108398, a .NET Framework update is required, regardless of the Windows version in use.

CVE-2026-92707 - MessagePack-CSharp

This final flaw is a denial of service issue in MessagePack-CSharp, a serialization library for .NET. It is tied to a poorly controlled sequential memory allocation and can be exploited remotely without authentication. Its 5.3 CVSS score makes it significantly less concerning.

The vulnerability CVE-2026-92707 affects Windows, Linux, and macOS if a vulnerable component is present. Microsoft’s site lists the affected applications and patches.

Final Patch Tuesday for several versions

This Patch Tuesday is also important because it marks the end of the line for several versions of Windows and Windows Server, depending on the edition. Here is a summary:

• Windows 11 24H2 Home and Pro, Windows 10 Enterprise LTSB 2016 : "The October 2026 monthly security update is the last update available for these editions", Microsoft says. It is time to move to a newer version, such as Windows 11 26H2, available since late September.
• Windows Server 2012 and 2012 R2 : the third and final year of the Extended Security Updates (ESU) program ends this month.
• Exchange Server 2016 and 2019 : the ESU program for these two versions ends in October 2026.
• Windows 11 23H2 Enterprise, Education, and IoT Enterprise : these editions will no longer receive security updates starting next month.

October 2026 Windows updates

Even though I plan follow-up articles on the new updates, here is the list of cumulative updates released this month:

For more on the topic, here are other articles:

• Windows 11 - October 2026 Update
• Windows 10 - ESU October 2026

Florian Burnel Co-founder of IT-Connect

Systems and network engineer, co-founder of IT-Connect and Microsoft MVP "Cloud and Datacenter Management". I'd like to share my experience and discoveries through my articles. I'm a generalist with a particular interest in Microsoft solutions and scripting. Enjoy your reading.

See Full Bio