Microsoft’s October 2026 Patch Tuesday addresses a record 1,411 vulnerabilities, 70 of them rated Critical (57 remote code execution, 11 elevation of privilege, 2 spoofing). By category that is roughly 677 elevation of privilege, 317 remote code execution, 254 information disclosure, 73 denial of service, 40 security feature bypass and 28 spoofing flaws. BleepingComputer counts only bugs released on Patch Tuesday itself, so the figure excludes another 348 fixed earlier in the month, and notes that Microsoft is increasingly using AI platforms to find and fix bugs.
One flaw is exploited in the wild: CVE-2026-96951, a Windows Shell security feature bypass that lets attackers get around Mark of the Web, the warning Windows attaches to files downloaded from the internet. No details have been shared on how it was abused or who reported it. Two more were publicly disclosed before a fix: CVE-2026-108398, a .NET Framework bypass that can defeat Windows Defender Application Control (found by Google Project Zero’s James Forshaw), and CVE-2026-92707, a denial-of-service flaw in MessagePack-CSharp.
This update is also the last one for two editions: Windows 11 version 24H2 Home and Pro, and Windows 10 Enterprise LTSB 2016 reached end of support today. Windows 11 23H2 Enterprise, Education and IoT Enterprise follow next month.
How to check if you’re affected
Affected devices are any Windows PCs that have not installed the October 2026 cumulative update, so install it through Windows Update (Settings > Windows Update > Check for updates) and restart. The exploited bug, CVE-2026-96951, is in Windows Shell, so this applies broadly rather than to a single edition.
If a device runs Windows 11 version 24H2 Home or Pro, or Windows 10 Enterprise LTSB 2016, check your version with winver: these editions get no further security updates after this one, so move to a newer Windows 11 release (or, for LTSB 2016, a supported edition) rather than staying put. Windows 10 devices enrolled in Extended Security Updates receive the separate KB5126657 update.