Microsoft's October 2026 Patch Tuesday Fixes Over 1,400 Flaws, Including an Already-Exploited Windows Zero-Day

Microsoft released its monthly Patch Tuesday security updates on October 13, 2026, fixing more than 1,400 vulnerabilities across its product line. Security outlets that track the releases called it the largest single Patch Tuesday batch to date, though their exact counts varied depending on methodology, with figures reported between roughly 1,407 and 1,415 fixes and around 70 to 80 of them rated Critical.

Among the flaws were three zero-days, meaning they became publicly known before Microsoft had a patch ready. One, tracked as CVE-2026-96951, was already being exploited by attackers at the time of release. Microsoft rated it 8.8 out of 10 for severity. The bug sits in Windows Shell and lets an attacker craft a file that evades Mark of the Web, the tag Windows normally attaches to files downloaded from the internet so that security tools and users are warned the file came from outside the system.

A second zero-day, CVE-2026-108398, affects the .NET Framework and could let an attacker bypass Windows Defender Application Control, a feature designed to stop unauthorized applications from running. Details of this flaw were public before Microsoft shipped a fix, though it had not been confirmed as exploited in the wild at the time of the release.

The update coincided with the end of support for Windows 11 version 24H2 Home and Pro editions and for Windows 10 Enterprise LTSB 2016. Those versions will stop receiving security fixes going forward unless covered by an extended support agreement, leaving any unpatched machines increasingly exposed over time.

Security researchers covering the release pointed administrators to the actively exploited Windows Shell flaw as the top priority for patching, since it is the one vulnerability in this batch confirmed to be in use against real targets. The sheer size of the update also means IT teams face a larger-than-usual testing and rollout job this month across servers, desktops, and cloud-connected Windows systems.

The release is a reminder that patching discipline remains one of the most effective defenses most organizations and individuals have against intrusion, since an exploited flaw with a fix available is a far easier target to close than one still unknown to the vendor.