Overview
- Microsoft released patches for about 1,413 vulnerabilities in its October Patch Tuesday, with roughly 1,102 affecting Windows in a record update on Wednesday, October 14, 2026.
- One actively exploited zero-day, CVE-2026-96951, is a Windows Shell command‑injection that can bypass Mark of the Web warnings and was added to CISA's Known Exploited Vulnerabilities list with a federal fix deadline of October 16, 2026.
- Two other flaws were publicly disclosed before patches: CVE-2026-108398 allows attackers to bypass Windows Defender Application Control by abusing an untrusted .NET assembly search path and CVE-2026-92707 is a MessagePack‑CSharp denial‑of‑service issue.
- Microsoft introduced 'risk cohorts' to group related CVEs for faster triage, and vendors and researchers are urging teams to first patch actively exploited, publicly disclosed, externally exposed, and identity- or network‑critical bugs such as Outlook preview‑pane RCEs and wormable service flaws.
- The update coincides with end‑of‑servicing and ESU expirations for Windows 11 24H2, Windows Server 2012/2012 R2 and Office 2021, which raises migration pressure and complicates long‑term patching plans for organizations.