Microsoft October 2026 Patch Tuesday Fixes Over 1,400 Vulnerabilities Including Actively Exploited Zero-Day

Microsoft's October 2026 Patch Tuesday release addressed more than 1,400 security vulnerabilities across Windows, Office, SharePoint, SQL Server, Exchange Server, and cloud-based services. Security trackers reported the total count of fixed flaws ranging from 1,411 to 1,771, making it one of the largest single-month security update cycles in Microsoft's history. Approximately 80 to 174 of the vulnerabilities were classified as critical in severity.

The primary security focus for the month was CVE-2026-96951, a high-severity security feature bypass vulnerability in the Windows Shell that was confirmed as actively exploited in the wild. The flaw carries a CVSS score of 8.8 and allows attackers to bypass Mark of the Web defenses, stripping trust boundaries that normally trigger security warnings for files downloaded from the internet.

A second publicly disclosed vulnerability, CVE-2026-108398, affects the .NET Framework and allows an authenticated local attacker to bypass Windows Defender Application Control enforcement. It also carries a CVSS score of 8.8.

A significant portion of the critical vulnerabilities involved remote code execution. Several RCE vulnerabilities were patched across Office applications including Word, Excel, PowerPoint, and Visio. CVE-2026-105016, a critical heap-based buffer overflow in Microsoft QUIC, allowed exploitation via specially crafted IPv6 packets without user interaction.

Security professionals were urged to conduct rigorous testing before wide-scale deployment given the volume of patches. Organizations were specifically advised to treat the actively exploited CVE-2026-96951 with the highest priority.

Alongside the security fixes, Microsoft signaled the end of support for Windows 11 version 24H2 Home and Pro editions and Windows 10 Enterprise LTSB 2016, urging users to transition to newer supported releases.