Overview
- Microsoft released the October Patch Tuesday updates on Tuesday, delivering about 1,413 fixes that affect many products with roughly 1,102 flaws in Windows alone.
- The company patched an actively exploited Windows Shell zero‑day, CVE‑2026‑96951, which bypasses Mark of the Web protections and has been added to CISA’s Known Exploited Vulnerabilities list with a federal mitigation deadline of October 16, 2026.
- Two other vulnerabilities were publicly disclosed before fixes (CVE‑2026‑108398 can bypass Windows Defender Application Control and CVE‑2026‑92707 is a MessagePack‑CSharp DoS), increasing urgency for targeted patching.
- Microsoft introduced 'risk cohorts' to group related CVEs so defenders can triage the large backlog, and vendors recommend prioritizing proved, public and wormable critical RCEs over lower‑risk listings.
- The release coincides with end‑of‑servicing steps for Windows 11 24H2 and expiry of ESUs for some Server 2012 builds, meaning organizations must fast‑track migrations or apply compensating controls as they deploy urgent patches.