Windows October 2026 update fixes record 1,413 flaws

Microsoft has released its October 2026 security update with fixes for a record 1,413 vulnerabilities, including a Windows flaw that is already being used in attacks. The Windows Shell zero-day, tracked as CVE-2026-96951, carries a severity score of 8.8 and lets a malicious file sidestep Windows safety checks after it arrives by email or messaging.

The flaw defeats Mark of the Web, the mechanism that labels files downloaded from the internet and triggers warnings before they run. An attacker must still persuade the user to open the crafted file, so the exploit depends on deception rather than silent intrusion. Microsoft has not said who is carrying out the attacks or who has been targeted. The US Cybersecurity and Infrastructure Security Agency added the flaw to its exploited vulnerabilities catalogue on October 13 and ordered federal agencies to patch by October 16.

The scale of this month’s release sets a fresh record. Microsoft counted 1,102 Windows vulnerabilities, 134 in Office, 61 in developer tools, 36 in SharePoint Server and 22 in SQL Server. More than 670 flaws enable privilege escalation, over 300 allow remote code execution and more than 70 are rated critical. The company has now fixed over 4,000 vulnerabilities in 2026, already surpassing last year’s total. Researchers attribute the growth partly to artificial intelligence tools that speed up bug hunting on both the defensive and attacking side.

Two further flaws were publicly disclosed before patches existed. CVE-2026-108398, an 8.8-rated .NET Framework bypass found by Google Project Zero’s James Forshaw, lets an attacker with local access run unauthorised code inside a protected process without any user interaction. CVE-2026-92707 is a lower-severity denial-of-service flaw in MessagePack-CSharp. Microsoft also patched CVE-2026-21413, a 9.8-rated heap buffer overflow in the Raw Image Extension that can run hostile code when Windows generates a thumbnail of a crafted RAW photo, even if the file is never opened. The release additionally closes critical remote code execution holes in Exchange Server and Active Directory Domain Services.

For Windows 11 users, the fixes arrive through KB5127648 for versions 24H2, 25H2 and 26H2, KB5126653 for version 23H2 and KB5127646 for version 26H1. The updates install automatically through Windows Update and can be forced manually from the settings menu.

One important deadline sits alongside the patches. Windows 11 version 24H2 Home and Pro reached end of updates on October 13, so this is the final security release for those editions unless users move to a newer version or paid support. Microsoft also continues its replacement of Secure Boot certificates, with the 2011 production certificate that signs the Windows boot loader set to expire on October 19. Devices that keep Windows Update switched on receive the new certificates automatically.

One known issue remains. Some USB Audio Class 1.0 devices, including headsets and external audio interfaces, may fail to start or lose sound after updating, a fault carried over from September that Microsoft has not fully resolved.

To help administrators cope with the volume, Microsoft introduced risk cohorts, which group vulnerabilities needing similar assessment. The company published 15 cohorts for October and advised customers to still weigh each flaw for active exploitation, severity and attack vector.