By Rebecca Stone

Microsoft's October 2026 Patch Tuesday is the year's largest release, with 1,408 CVEs requiring customer action and 72 rated critical. September, the previous high, carried 963. One flaw is already exploited: CVE-2026-96951, a Windows Shell security feature bypass that evades Mark of the Web (the flag applied to files downloaded from the internet). CISA added it to its known exploited vulnerabilities list on 13 October, with a remediation date of 16 October.

Two CVEs were publicly disclosed before release: one in the .NET Framework, CVE-2026-108398, and CVE-2026-92707 in the MessagePack-CSharp library. Separately, on 25 September Microsoft reported active attacks against CVE-2026-65660, a SharePoint Server remote code execution flaw fixed in August. The Security Update Guide still shows "Exploited: No" for that CVE, so a report filtered on the flag will miss it. Any SharePoint server without the August update should receive it now.

What should administrators patch first?

Readiness recommends a Patch Now schedule for Windows, Office, Exchange and developer tooling. SQL Server follows a standard schedule. Windows takes 1,122 CVEs, 42 of them critical, with elevation of privilege accounting for 617 entries. The exploited Shell flaw requires a user to open a crafted file or follow a link. DHCP Server takes 52 fixes, Win32k 48, the Windows Kernel 46 and Windows Installer 38.

Office carries 180 CVEs, 26 critical, with remote code execution accounting for 107. Excel alone takes 69 fixes. SharePoint Server Subscription Edition takes 34 CVEs in KB5002927. Exchange Server has seven CVEs across supported versions, including one critical remote code execution flaw, CVE-2026-70571. A seventh, CVE-2026-96940, published 2 October, maps to separate updates KB5129955 through KB5129958, so administrators should confirm both sets are installed. SQL Server has 22 CVEs, none critical.

Developer tooling carries 66 CVEs. Both critical entries also affect Windows, including CVE-2026-105016, a Microsoft QUIC remote code execution flaw requiring no authentication or user interaction. It affects .NET 8, 9, 10 and 11 and Visual Studio 2022 and 2026.

Adobe published 11 bulletins the same day, covering 175 CVEs across ColdFusion, Experience Manager, Commerce and other products. None is rated priority 1 and Adobe is aware of no exploits.

Which known issues affect deployment?

On 14 October Microsoft added a known issue to the Windows 11 updates KB5127648 (24H2, 25H2, 26H2) and KB5127646 (26H1). Non-admin users might fail to open Remote Desktop connections to hosts with Administrator protection enabled, with error 0xC000000D. The Windows 11 security baselines enable Administrator protection by default, so remote access to managed hosts should be tested before broad rollout. Microsoft's mitigation is to disable the feature temporarily through policy management.

Two further issues remain open:

• Some USB Audio Class 1.0 devices might fail to start or produce no sound.
• WSUS still does not display synchronisation error details on Server 2025 and Server 2022, a function Microsoft removed to address CVE-2025-59287 with no workaround.

Three issues closed this month, including the false "Microsoft Defender Antivirus is turned off" notifications, fixed by update 4.18.26080.4 on 17 September, and Explorer failing to start on multi-user systems such as Azure Virtual Desktop with FSLogix.

What changed between releases?

Between 9 September and 12 October, the Security Update Guide covered 111 entries for Microsoft products, 90 of them revisions; September's window had one. On 17 September, 84 September CVEs gained Office for Mac updates. On 16 September, Microsoft corrected the scoring of three critical SQL Server flaws — CVE-2026-67378, CVE-2026-67631 and CVE-2026-67643 — to record that "an attacker does not require any privileges". Of 21 new entries, 18 are critical cloud-side flaws in Azure, Microsoft 365 Copilot, Dataverse and Fabric, all marked as requiring no customer action.

Which support deadlines took effect?

On 13 October, Office 2021 and Office LTSC 2021 reached end of support. Windows 10 Enterprise 2016 LTSB reached end of extended support. Extended Security Updates for Windows Server 2012 and 2012 R2 ended, making the October update the final one for both. Windows 11 Home and Pro 24H2 reached end of updates, and Windows Server 2022 moved to extended support through 14 October 2031.

On 10 November, .NET 8 and 9, PowerShell 7.4 and 7.5, and Windows 11 Enterprise and Education 23H2 all reach end of support or updates. Microsoft says November's update "will be the last update available for these editions".

Enforcement also tightens with this release. Windows 11 24H2 through 26H2 and Server 2025 now restrict NTLMv1-derived credentials for single sign-on by default, which Microsoft warns "might affect Wi-Fi, Ethernet and VPN connections that use MS-CHAPv2-based authentication" (KB5066470). The Windows Production PCA 2011 Secure Boot certificate expires 19 October; devices without its UEFI CA 2023 replacement keep updating but stop receiving new early-boot protections.

How much testing is required?

Microsoft's test guidance lists 496 Windows entries, 41 flagged high risk, against 466 and 55 in September. Printing, scanning and font rendering account for 31 of the 41. Recommended priorities include printing mixed-font documents across printer types, opening downloaded files to confirm SmartScreen warnings still appear, Remote Desktop tests with non-admin accounts, MSI package installs, and DNS (52 fixes) and DHCP (18 fixes) servers under load.

Microsoft published no mitigations and no workarounds in the October release. For the third consecutive month, no browser CVEs appear in Patch Tuesday itself; Edge fixes arrived between releases as 414 CVEs, 409 republished from Chromium, none exploited.