Microsoft October 2026 Patch Tuesday fixes 1,400+ flaws, a record batch with one exploited Windows Shell zero-day
Microsoft released updates fixing more than 1,400 vulnerabilities in Windows and other software, far above September's record of nearly 1,000 fixes. Only one flaw is a confirmed zero-day exploited in the wild: CVE-2026-96951, a security feature bypass in Windows Shell affecting Windows 10, Windows 11 and some Windows Server versions. At least 78 of the flaws are rated critical, and most of those allow remote code execution. Tenable's Satnam Narang noted that the 4,000 CVE mark has been crossed for the year with two months left, surpassing the 2020 record of 1,261 CVEs in a full year. Microsoft credits large language models for the high volume of bug discovery, and experts warn that these huge batches strain security teams that must test patches before deployment.
Detalhes técnicos
- CVE-2026-96951: security feature bypass in Windows Shell, exploited in the wild; affects Windows 10 and 11 and some Server versions.
- CVE-2026-108398: security feature bypass in .NET Framework, publicly disclosed before the patch; Microsoft reports no signs of exploitation yet, but public disclosure gives attackers a head start.
- At least 78 flaws are rated critical, most allowing arbitrary code execution.
- Per Fortra's Tyler Reguly, only 26 Microsoft vulnerabilities have appeared in CISA's Known Exploited Vulnerabilities (KEV) catalog so far this year.
- Windows 10 free updates were extended past October 2025, and Microsoft later quietly extended that support until October 2027.
Remediação
- Deploy the October updates, prioritizing the exploited Windows Shell zero-day CVE-2026-96951 and the publicly disclosed CVE-2026-108398.
- Prioritize the 26 Microsoft CVEs in the CISA KEV catalog, focusing on exploitable risk rather than raw patch volume.
- Test updates before wide deployment, given the unusually large patch load.
- Consult the Cisco Talos and SANS Internet Storm Center roundups to triage by severity, CVE and affected software.
Linha do tempo
-
Microsoft October 2026 Patch Tuesday fixes 1,400+ flaws, a record batch with one exploited Windows Shell zero-day
Krebs adds context beyond the existing coverage: the batch dwarfs September's near-1,000 record, 78 flaws are rated critical (Action1 counted 80), Tenable says 2026 has passed 4,000 CVEs versus the 2020 record of 1,261, and Microsoft credits LLMs for the discovery volume. It also reports that Windows 10 support was quietly extended to October 2027, that only 26 Microsoft CVEs are in CISA KEV this year (Fortra), and that the patch volume strains security teams.
ler a análise desta fonte ocultar
Krebs adds context beyond the existing coverage: the batch dwarfs September's near-1,000 record, 78 flaws are rated critical (Action1 counted 80), Tenable says 2026 has passed 4,000 CVEs versus the 2020 record of 1,261, and Microsoft credits LLMs for the discovery volume. It also reports that Windows 10 support was quietly extended to October 2027, that only 26 Microsoft CVEs are in CISA KEV this year (Fortra), and that the patch volume strains security teams.
Microsoft released updates fixing more than 1,400 vulnerabilities in Windows and other software, far above September's record of nearly 1,000 fixes. Only one flaw is a confirmed zero-day exploited in the wild: CVE-2026-96951, a security feature bypass in Windows Shell affecting Windows 10, Windows 11 and some Windows Server versions. At least 78 of the flaws are rated critical, and most of those allow remote code execution. Tenable's Satnam Narang noted that the 4,000 CVE mark has been crossed for the year with two months left, surpassing the 2020 record of 1,261 CVEs in a full year. Microsoft credits large language models for the high volume of bug discovery, and experts warn that these huge batches strain security teams that must test patches before deployment.
Technical Details
- CVE-2026-96951: security feature bypass in Windows Shell, exploited in the wild; affects Windows 10 and 11 and some Server versions.
- CVE-2026-108398: security feature bypass in .NET Framework, publicly disclosed before the patch; Microsoft reports no signs of exploitation yet, but public disclosure gives attackers a head start.
- At least 78 flaws are rated critical, most allowing arbitrary code execution.
- Per Fortra's Tyler Reguly, only 26 Microsoft vulnerabilities have appeared in CISA's Known Exploited Vulnerabilities (KEV) catalog so far this year.
- Windows 10 free updates were extended past October 2025, and Microsoft later quietly extended that support until October 2027.
Remediation
- Deploy the October updates, prioritizing the exploited Windows Shell zero-day CVE-2026-96951 and the publicly disclosed CVE-2026-108398.
- Prioritize the 26 Microsoft CVEs in the CISA KEV catalog, focusing on exploitable risk rather than raw patch volume.
- Test updates before wide deployment, given the unusually large patch load.
- Consult the Cisco Talos and SANS Internet Storm Center roundups to triage by severity, CVE and affected software.
-
Microsoft October 2026 Patch Tuesday fixes ~1,400 flaws, including exploited Windows Shell zero-day CVE-2026-96951
ler a análise desta fonte ocultar
Microsoft's October 2026 Windows update patches roughly 1,410 security vulnerabilities, a figure that varies with how flaws are counted. According to patch management provider Action1, 80 are rated critical and two are zero-days. One zero-day, CVE-2026-96951, is a Windows Shell security feature bypass that has already been exploited in the wild. The other, CVE-2026-108398, affects .NET Framework and was publicly disclosed before a fix was available. The release is also the first for Windows 11 26H2 and the last for Windows 11 24H2 Home and Pro editions.
Technical Details
- CVE-2026-96951 (Windows Shell, exploited in the wild): lets a remote attacker bypass a Windows defense that protects users from potentially dangerous files. Per Action1, exploitation requires convincing users to open specially crafted files or interact with malicious content, so malicious content can reach users without the expected security warnings.
- CVE-2026-108398 (.NET Framework, publicly disclosed before the patch): lets an attacker bypass security measures.
- Affected: all editions of Windows 11 26H2, 26H1, 25H2 and 24H2, Windows 11 23H2 Enterprise and Education, and Windows 10 PCs enrolled in the Extended Security Updates (ESU) program.
- The update also includes non-security fixes for File Explorer and Bluetooth stability, and a new setting to remap the Copilot key.
Remediation
- Install the October update through Settings > Windows Update. It may already be downloaded and waiting for a reboot.
- Windows 11 24H2 Home and Pro have reached end of support and should be upgraded to 26H2.
- Windows 11 23H2 Enterprise and Education reach end of support on November 10. Organizations should plan the upgrade to a supported version before then.