Microsoft's October 2026 Patch Tuesday fixes 1,411 flaws, including one exploited zero-day

According to a BleepingComputer report dated 13 October 2026, Microsoft fixed 1,411 security flaws in its October Patch Tuesday update. The report calls the count a record and links it to Microsoft's ongoing use of AI platforms to find and fix vulnerabilities. Seventy flaws are rated critical: 57 remote code execution, 11 elevation of privilege and 2 spoofing.

• Exploited flaw: CVE-2026-96951 in Windows Shell allows attackers to bypass the Mark of the Web security feature; no details were shared on how it was exploited.
• Two publicly disclosed flaws: CVE-2026-108398 in .NET Framework, which can bypass Windows Defender Application Control (WDAC), and CVE-2026-92707, a denial-of-service flaw in MessagePack-CSharp.
• Approximate breakdown: 677 elevation of privilege, 317 remote code execution, 254 information disclosure, 73 denial of service, 40 security feature bypass and 28 spoofing flaws.
• Microsoft grouped related flaws into 15 risk cohorts; the largest covers 136 flaws in Windows filesystems, storage and backup.

Why it matters

Because the exploited flaw bypasses a Windows security feature, it may make sense to update user computers first this month. The report also notes that the October update was the last one for Windows 11 24H2 Home and Pro and for Windows 10 Enterprise LTSB 2016. Since these editions will get no further updates, companies still using them may need to plan a move to a supported version.

A month with this many fixes can strain testing and rollout. According to the report, Microsoft's risk cohorts are meant to help prioritise updates but do not replace its existing patching guidance. A reasonable order for IT teams could be to fix the exploited flaw and the critical remote code execution bugs first, then roll out the remaining updates on a planned schedule.