Patch Tuesday Sets Record With 1,411 Fixes and Shell Zero-Day

A record release with one bug that needs attention first

Microsoft's October 2026 Patch Tuesday is the largest security release the company has ever shipped. Most of the attention has gone to the size of the total, but the more urgent item is a single vulnerability. According to BleepingComputer's tally, the updates fix 1,411 flaws, and three of them are zero-days: one already used in attacks and two disclosed publicly before a fix existed.2 The outlet counts 70 of the fixes as Critical. Of those, 57 are remote code execution bugs, 11 are elevation of privilege flaws and 2 are spoofing issues.2

The actively exploited bug is CVE-2026-96951, a security feature bypass in Windows Shell that lets attackers get around Mark of the Web.2 Mark of the Web is the tag Windows puts on files downloaded from the internet. It triggers extra warnings and restrictions when those files are opened. Microsoft describes the cause as a command-injection weakness, meaning special characters in a command aren't properly neutralized, and says an unauthorized attacker can exploit it over a network.11 Microsoft hasn't said how the flaw was used in attacks or who reported it.2

That lack of detail is the most important fact about this release. Defenders know the bug is being exploited but have no indicators to look for, no named threat group and no description of how the attack works. Bypassing Mark of the Web isn't a full compromise by itself. Attackers use it to remove the warnings that would otherwise appear when a victim opens a malicious download, so it's usually one step in a longer attack chain. NTCompatible calls the Shell flaw the most important fix of the month, noting that Windows Shell handles the security prompts that sit between a user and a malicious file. Its point is that once those prompts are bypassed, attackers no longer need to trick users into clicking through them.

The two publicly disclosed flaws

The second zero-day matters most to enterprises. CVE-2026-108398 is a .NET Framework security feature bypass caused by an untrusted search path. Microsoft says an authorized attacker can exploit it locally.2 In practice, according to Microsoft, an authenticated attacker could plant a crafted .NET assembly and register it so that a protected process loads it. That gets around Windows Defender Application Control (WDAC) and lets the attacker run code inside the protected process, with no user interaction needed.11 James Forshaw of Google Project Zero found the flaw.2

The impact is serious for organizations that rely on WDAC to block unapproved software. An attacker who already has a foothold on a machine could use this bug to run code that the application allow-list was supposed to stop. WindowsForum puts it second in its patching order, right after the Shell flaw, for systems where WDAC enforcement matters.5

The third zero-day, CVE-2026-92707, is a denial-of-service bug in MessagePack-CSharp, an open-source serialization library for .NET. Microsoft attributes it to improperly controlled memory allocation that an unauthorized attacker can trigger over a network.2 Microsoft hasn't said who disclosed it.11 Because it's a library, a Windows update won't fully fix it. Developers who bundle MessagePack-CSharp in their own applications have to update it themselves.5

Outlets report different totals

The counts vary by outlet. BleepingComputer reports 1,411.2 Action1 counts 1,409 patches, 80 rated critical, and two zero-days rather than three.4 NTCompatible reports about 1,413 CVEs across 176 separate updates. The SANS-linked Patch Tuesday writeup puts the number at 1,417, with 76 critical, and lists one previously disclosed flaw and one exploited flaw. WindowsForum found a figure of 1,118 in coverage based on Microsoft's own risk-cohort briefing.5

These differences come from counting rules, not from disagreement about the facts. BleepingComputer counts only CVEs Microsoft published on Patch Tuesday itself. That leaves out 348 flaws fixed earlier in October in products such as Azure App Service, Exchange Server, Microsoft Bookings and Partner Center.11 WindowsForum notes that BleepingComputer's per-category numbers add up to 1,389 rather than 1,411, so those breakdowns are approximate.14 On the zero-day count, WindowsForum thinks Action1's figure of two reflects a narrower definition rather than a factual dispute.5

What matters for defenders is this: every outlet agrees that exactly one flaw is being exploited in the wild, and it's the Windows Shell bypass.5 Whether the total is 1,409 or 1,417 makes little practical difference. Security teams that report patch numbers to leadership should choose one counting method and use it every month.5

The early fixes may matter more

Much of the most severe October risk was fixed before Patch Tuesday. NTCompatible reports that an early security update listing ahead of the main release included a Microsoft Bookings issue rated 9.9 and a Partner Center flaw rated a perfect 10.0. Many of the cloud-hosted fixes need nothing from customers. The SANS writeup says seven of its critical items require no customer action. Still, the gap between the main bulletin and the earlier fixes means administrators who track only the second-Tuesday release are seeing an incomplete picture.

The main release also contains critical bugs that aren't zero-days but could be dangerous if exploited. Action1 highlights a critical remote code execution flaw in the Remote Desktop Gateway service, CVE-2026-70187, which an unauthenticated attacker can reach with crafted network packets. It also points to an Outlook remote code execution bug, CVE-2026-97749, rated CVSS 9.8, which it says needs neither authentication nor user interaction. Another is a Raw Image Extension flaw, CVE-2026-96943, which can be triggered when Windows simply generates a thumbnail preview of a malicious file. Action1's sysadmin guidance tells teams to look closely at identity and network services, including Active Directory, DNS, DHCP and Remote Desktop Services, and at Exchange, SharePoint and Hyper-V.8

Why the releases keep getting bigger

The record follows quickly on the previous one. Action1 notes that September's release of 995 patches had been the largest ever just a month earlier.4 NTCompatible traces the growth from roughly 570 CVEs in July to nearly 1,000 in September to about 1,413 now. BleepingComputer links the increase to Microsoft's ongoing use of AI tools to find and fix vulnerabilities in its own products.11

This looks like more bugs being found faster, not a sudden drop in code quality. Automated discovery turns up flaws that were already there, and Microsoft is choosing to fix them in bulk. The cost lands on patch-management teams, which now have to test and deploy releases several times larger than they handled a year ago. Action1's executive summary says releases this large force security leaders to stop prioritizing mainly by CVSS score and instead weigh exploitability, network exposure and business criticality.7

Microsoft's answer is a new triage feature. It introduced "risk cohorts," which group vulnerabilities by questions about a customer's environment, and it announced general availability of Hotpatching for Windows Server 2025 Azure Edition VMs. WindowsForum supports the cohort approach but sees a risk. A team can answer once whether it exposes RD Gateway and apply that answer to dozens of CVEs, but if teams rank cohorts by size, a single exploited CVE like the Shell bypass can get buried.5 That concern is justified. Grouping helps with the large volume of theoretical bugs, but known exploitation should still be the first factor in deciding what to patch.

End of support for some Windows editions

This release is also the last one for some machines. Microsoft confirmed that Windows 11 version 24H2 Home and Pro and Windows 10 Enterprise LTSB 2016 reached end of updates on October 13, so the October security update is their final patch.11 On Windows 11, the fixes ship in KB5127648, which brings 26H2, 25H2 and 24H2 to builds 26300.9711, 26200.9711 and 26100.9711.5 Windows 10 systems enrolled in Extended Security Updates get the same fixes in KB5126657.10

The priorities are clear even if the totals aren't. Deploy the Windows Shell fix everywhere first, since it's the only flaw confirmed under attack. Next, close the WDAC bypass on machines where application control matters, and update MessagePack-CSharp wherever it's bundled. After that, use exposure and asset criticality to work through the remaining critical bugs. Devices that just lost support should be upgraded, because they won't get fixes for whatever is in next month's release.5