Microsoft October 2026 Patch Tuesday Tackles 1,411 Flaws, Including 3 Zero-Days

Microsoft has addressed a record-breaking 1,411 security vulnerabilities in its October 2026 Patch Tuesday updates, including one actively exploited zero-day and two publicly disclosed zero-days.

The company released its latest Windows security updates on October 13, fixing 70 Critical vulnerabilities, including 57 remote code execution flaws, 11 elevation of privilege flaws, and two spoofing vulnerabilities.

According to BleepingComputer, the unusually high number of fixes comes as Microsoft increasingly uses AI tools to identify and address security weaknesses.

More than 600 privilege escalation vulnerabilities fixed

Elevation of privilege flaws accounted for the largest share of vulnerabilities addressed this month, followed by remote code execution and information disclosure issues.

The October security updates include:

• 677 Elevation of Privilege vulnerabilities
• 317 Remote Code Execution vulnerabilities
• 254 Information Disclosure vulnerabilities
• 73 Denial of Service vulnerabilities
• 40 Security Feature Bypass vulnerabilities
• 28 Spoofing vulnerabilities

Remote code execution vulnerabilities remain particularly concerning because attackers can potentially exploit them to execute malicious code on vulnerable systems.

Microsoft fixes actively exploited Windows Shell zero-day

The most urgent fix addresses CVE-2026-96951, a Windows Shell security feature bypass vulnerability that attackers have already exploited in the wild.

The flaw allows attackers to bypass Mark of the Web (MotW), a Windows security mechanism that identifies files downloaded from the internet and applies additional protections.

The vulnerability stems from improper handling of special characters in commands, which can allow attackers to circumvent these protections.

Microsoft has not provided details about the attacks or identified the researchers who discovered the vulnerability.

Two additional zero-days were publicly disclosed

Microsoft also patched two publicly disclosed vulnerabilities, although neither had confirmed active exploitation.

The first, CVE-2026-108398, affects the .NET Framework and allows authenticated attackers to bypass Windows Defender Application Control (WDAC).

Attackers can exploit the flaw by placing a specially crafted .NET assembly on a vulnerable system and loading it through a protected process. The attack does not require user interaction.

The second, CVE-2026-92707, affects MessagePack-CSharp and allows remote attackers to trigger denial-of-service conditions through uncontrolled memory allocation.

Microsoft has not identified the researcher responsible for discovering the MessagePack-CSharp vulnerability.

Windows 11 24H2 and Office LTSC 2021 also reach end of support

The October Patch Tuesday release coincides with the end of support for several Microsoft products.

Windows 11 24H2 Home and Pro editions reached end of support on October 13, 2026. Users running these editions need to upgrade to a supported Windows version to continue receiving security updates.

Meanwhile, Office LTSC 2021, Visio LTSC 2021, and Project LTSC 2021 also reached end of support on the same day.

With one zero-day already under active exploitation and hundreds of remote code execution vulnerabilities addressed, users and IT administrators should prioritize installing the October security updates on supported systems.