Microsoft patches record 1,411 flaws in October 2026 Patch Tuesday
Microsoft's October 2026 Patch Tuesday release addressed a record-breaking 1,411 security vulnerabilities across its product lineup, marking one of the largest monthly update batches in the company's history. The update included 70 vulnerabilities classified as 'Critical,' with 57 of those being remote code execution flaws, 11 elevation of privilege issues, and two spoofing vulnerabilities.
Breakdown of vulnerability types in the October update
The distribution of flaws across categories revealed significant concentrations in certain areas: 677 elevation of privilege vulnerabilities, 317 remote code execution issues, 254 information disclosure flaws, 254 denial of service vulnerabilities, 73 spoofing issues, and 40 security feature bypass vulnerabilities. These numbers reflect only the vulnerabilities released specifically on Patch Tuesday, excluding 348 additional flaws fixed earlier in the month for products such as Azure services, Microsoft Exchange Server, and Microsoft Partner Center.
Three zero-day vulnerabilities addressed in October update
Among the fixes were three zero-day vulnerabilities: one actively exploited and two that had been publicly disclosed prior to the patch release. Microsoft defines a zero-day as a flaw for which no official fix was available at the time of disclosure or exploitation.
Actively exploited zero-day: Windows Shell security bypass
The actively exploited zero-day was tracked as CVE-2026-96951, a Windows Shell Security Feature Bypass Vulnerability. This flaw allowed attackers to bypass the Mark of the Web security feature through improper neutralization of special elements in a command, enabling command injection over a network. Microsoft did not disclose details about the exploitation method or the reporting party.
Publicly disclosed zero-days: .NET Framework and MessagePack-CSharp flaws
The two publicly disclosed zero-days were:
- CVE-2026-108398: A .NET Framework Security Feature Bypass Vulnerability that could allow attackers to bypass Windows Defender Application Control (WDAC) and execute unauthorized applications. An authenticated attacker could place a malicious .NET assembly on a system to be loaded by a protected process, enabling code execution within that context without user interaction. The vulnerability was discovered by James Forshaw of Google Project Zero.
- CVE-2026-92707: A Denial of Service Vulnerability in MessagePack-CSharp resulting from improperly controlled sequential memory allocation, which could allow an unauthorized attacker to deny service over a network. The disclosing party was not identified by Microsoft.
End of support announced for Windows 11 24H2 and Windows 10 LTSB 2016
On the same day, Microsoft announced that Windows 11 version 24H2 Home and Pro editions, along with Windows 10 Enterprise LTSB 2016, had reached end of support. The October 2026 security update was confirmed as the final release for these operating system editions. Microsoft stated: "Today, October 13, 2026, Windows 11, version 24H2 Home and Pro, and Windows 10 Enterprise LTSB 2016 have reached end of updates. The October 2026 monthly security update is the last update available for these editions."
Additionally, Microsoft advised organizations using Windows 11 23H2 Enterprise, Education, and IoT Enterprise editions to upgrade to newer versions, as those systems would cease receiving security updates starting the following month.
Other vendors release October 2026 security updates
Multiple other vendors issued security advisories and updates during October 2026:
- Adobe released patches for Commerce, Substance 3D Samples, ColdFusion, Photoshop, Dimension, and Framework products.
- Atlassian addressed a critical vulnerability (CVE-2026-21589) in Confluence, Jira, and Bitbucket Data Center products, which was exploited shortly after a proof-of-concept was made public.
- Cisco fixed critical flaws in NX-OS that could allow attackers to gain root-level arbitrary code execution on Nexus switches.
- Citrix released updates for NetScaler ADC and Gateway, noting that CVE-2026-88779 had been exploited in zero-day attacks prior to patching.
- Dell resolved critical vulnerabilities in the System Update (DSU) CLI tool and Container Storage Modules (CSM).
- Docker patched a flaw in DockerHub that could allow attackers to impersonate users and push unauthorized images to repositories.
- Fortinet addressed a critical FortiMail vulnerability (CVE-2026-104286) that had been exploited in zero-day attacks.
- GitLab released updates for critical flaws in AI Gateway and CI/CD Regular Expression Compiler components.
- Ivanti patched an actively exploited zero-day in Ivanti Connect Secure (ICS) remote access gateways.
- Kiteworks issued updates for 126 vulnerabilities, including a maximum-severity flaw in its Email Protection Gateway (EPG).
- Progress Software updated MarkLogic Server to address critical and high-severity security issues.
- SAP released its October update, fixing 20 flaws including a maximum-severity OAuth2 SSRF vulnerability in the Cloud SDK for Python.
- SonicWall resolved a critical SMA1000 server-side request forgery (SSRF) flaw that was exploited within two days of disclosure.
Source: BleepingComputer