October 2026 Patch Tuesday, reported October 14, 2026
Microsoft Ships a Record 1,413 Fixes, Including an Exploited Windows Zero-Day
Microsoft's October 2026 Patch Tuesday resolved 1,413 vulnerabilities, more than the company patched in all of 2025, including 1,102 in Windows alone. The most urgent is CVE-2026-96951, a Windows Shell security feature bypass with a CVSS score of 8.8 that is already being exploited; it strips away Mark of the Web protections, so a downloaded file can run without the SmartScreen and Office Protected View warnings users rely on. CISA added the flaw to its Known Exploited Vulnerabilities catalog and directed federal agencies to remediate by October 16. Two further flaws, a Windows Defender Application Control bypass (CVE-2026-108398) and a denial of service in MessagePack-CSharp (CVE-2026-92707), were publicly known before fixes shipped.
Executives
The sheer volume is the story: one month of Microsoft fixes exceeded the entire prior year. Sustained patching capacity, not one heroic weekend, is what keeps this from becoming an incident. Ask whether October updates are fully deployed, not just scheduled.
CIO / CISO
Prioritize by exploitation, not by count. CVE-2026-96951 is confirmed exploited and KEV-listed; the SharePoint token flaw (CVE-2026-102866) and the Outlook preview pane issues deserve fast lanes too. Microsoft's new risk cohorts are a reasonable starting point for sequencing, with your own exposure data on top.
Engineers
Deploy the October cumulative updates to internet-facing and user-facing Windows systems first, and verify Mark of the Web handling after patching. Watch for Office documents and scripts launching without Protected View prompts, and confirm Defender Application Control policies still enforce as expected.
Everyone (non-IT)
Restart your computer when it asks for updates this month. One of the fixed flaws removes the warning screens that normally stop a booby-trapped download, so running the update is what puts those warnings back.