Microsoft October 2026 Patch Tuesday Fixes Over 1,400 Flaws and One Exploited Zero-Day
Do Son 
TL;DR
Microsoft’s October 2026 Patch Tuesday fixes 1,414 vulnerabilities, including 78 rated critical, making it the company’s largest release yet. Three zero-day vulnerabilities are addressed, and attackers are already exploiting one of them. CISA wants federal agencies to patch that flaw by October 16, 2026.
- Product: Microsoft (2 products)
- Vulnerabilities: 3 flaws (CVE-2026-96951, CVE-2026-108398, CVE-2026-92707)
- Highest severity: 8.8 (High · CVSSv3)
- Worst impact: Windows Shell Security Feature Bypass
- Status: 2 exploited; patches available
- Action: Update to 20260925.100, 10.0.14393.9612, 10.0.17763.9376, 10.0.19044.7807 (+15) now
| CVE | CVSS (CVSSv3) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-96951 | 8.8 | CWE-77 | 20260925.100, 10.0.14393.9612, 10.0.17763.9376 (+9) | Exploited |
| CVE-2026-108398 | 8.8 | CWE-426 | 2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0, 2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0, 2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0 (+4) | Not exploited |
| CVE-2026-92707 | 5.3 | Awaiting analysis | — | Exploited |
Why It Matters
The volume alone is striking. This month’s count tops September’s record of more than 970 fixes. As a result, patch teams face a heavy testing load at the same time an exploited flaw demands quick action.
What counts as a zero-day
Microsoft labels a flaw a zero-day when it is publicly disclosed or actively exploited before an official fix exists. Under that definition, this month brings three zero-day vulnerabilities. The exploited one, CVE-2026-96951, carries a CVSS score of 8.8.
How the Attacks Work
CVE-2026-96951: exploited Windows Shell bypass
This flaw lets attackers bypass Mark of the Web, the Windows feature that flags files downloaded from the internet. Microsoft warns that command injection in Windows Shell “allows an unauthorized attacker to bypass a security feature over a network.” Without that flag, malicious files may skip the usual warnings.
CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 13. Microsoft has not said who exploited it or how.
CVE-2026-108398: .NET Framework bypass
This publicly disclosed flaw could let attackers slip past Windows Defender Application Control. According to Microsoft, “Successful exploitation could bypass Windows Defender Application Control restrictions and allow the attacker to execute code within the protected process.” James Forshaw of Google Project Zero found it.
CVE-2026-92707: MessagePack-CSharp denial of service
The second publicly disclosed bug lets a remote attacker crash .NET apps that use MessagePack-CSharp through uncontrolled memory allocation.
Exploitation status
Microsoft and CISA confirm active exploitation of CVE-2026-96951. The other two zero-days were publicly disclosed, but no exploitation has been confirmed.
Affected Products
The October 2026 Patch Tuesday release spans Windows, .NET Framework and other Microsoft products and services. Full product and version details sit in the Microsoft Security Update Guide.
Patch and Mitigation Steps
- Patch CVE-2026-96951 first, ideally before CISA’s October 16 deadline.
- Update .NET Framework on systems that rely on Windows Defender Application Control.
- Review the 78 critical fixes and prioritize internet-facing systems.
- Warn users to treat downloaded files with extra caution until patches land.
Given its size, the October 2026 Patch Tuesday will take time to roll out. Still, the exploited Windows Shell flaw should not wait.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
