October 2026 Patch Tuesday: Windows zero-day to fix now

Quick answer: Install the October 2026 Windows update now. Microsoft’s Patch Tuesday on 13 October fixed a record number of vulnerabilities, and one Windows Shell flaw, CVE-2026-96951, is already being exploited. Windows 11 24H2 Home and Pro also reached end of support.

Microsoft’s October 2026 security release is the largest on record. Outlets count it differently, from 1,407 CVEs (Tenable) to 1,413 (SecurityWeek) and 1,415 (Petri), because some tallies include fixes released earlier in the month. The exact number matters less than the one flaw attackers are already using.

The affected software is Windows, Office, SharePoint, SQL Server, Exchange and Azure, so home users, small businesses and IT teams in the US, UK, Canada, Australia and the EU all have something to install. This guide covers what changed, which bug to worry about and what to do.

What is the exploited zero-day?

The actively exploited bug is CVE-2026-96951, a Windows Shell security feature bypass with a CVSS score of 8.8. It lets an attacker get around Mark of the Web, the label Windows attaches to files that come from the internet. SecurityWeek reports that the Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalog on 13 October and gave US federal agencies until 16 October to fix it.

Dark Reading explains why that matters. A Mark of the Web bypass can switch off SmartScreen, Office Protected View, the Office macro block, Smart App Control and the Attachment Manager prompt. Those are the warnings that normally appear when you open a file from an email or download.

An attack still needs a person to act. Tenable says the flaw is abused through social engineering, such as a file sent by email or messaging app that the target is tricked into opening. It is the third Windows Shell flaw exploited in the wild in 2026, after CVE-2026-21510 in February and CVE-2026-32202 in April.

Are there other zero-days or serious bugs?

Two flaws were publicly disclosed before a patch existed. CVE-2026-108398 is a .NET Framework bypass of Windows Defender Application Control, reported by James Forshaw of Google Project Zero, according to BleepingComputer. CVE-2026-92707 is a denial-of-service bug in MessagePack-CSharp. Microsoft rates exploitation of the .NET flaw as “less likely”, per Dark Reading.

Several other fixes carry high scores. Dark Reading lists CVE-2026-70242, an Outlook Reading Pane remote code execution flaw (CVSS 9.8) that needs no user interaction beyond viewing a crafted email, and CVE-2026-105016, a Microsoft QUIC flaw (CVSS 9.8) that could allow unauthenticated remote code execution. Tenable highlights Exchange Server CVE-2026-70279 (CVSS 9.3) and CVE-2026-70571 (CVSS 8.1), both rated “Exploitation More Likely”. None of these are reported as exploited yet.

Why is the patch count so high?

SecurityWeek says Microsoft patched more flaws this month than in all of 2025 and attributes much of the surge to AI-assisted bug finding. Dark Reading quotes ZDI’s Dustin Childs saying AI speeds up discovery on both the attack and defense side but does not create the underlying bugs. Fortra’s Tyler Reguly argues raw CVE counts are not meaningful: Dark Reading cites his estimate that under 1% of this year’s Microsoft patches are known to be exploited.

The takeaway for ordinary users is simple. Big numbers do not mean every PC is under attack. They mean updates should be installed on schedule, with the exploited bug first.

How do I install the October update?

Open Settings, then Windows Update, and select Check for updates.
Install the cumulative update and restart when asked. Petri lists KB5127648 for Windows 11 24H2, 25H2 and 26H2, and KB5127646 for 26H1.
Back up important files first. Our guide to backing up Windows 11 shows how.
Check Settings, Windows Update, Update history to confirm the update installed.
Update Office apps and Exchange or SharePoint servers too, if you run them.

Until you are patched, be cautious with unexpected attachments and downloads, since this bug removes the usual warnings. Our guide on where to report a scam covers what to do if a suspicious file arrives.

Which Windows versions just lost support?

BleepingComputer reports that Windows 11 24H2 Home and Pro, and Windows 10 Enterprise 2016 LTSB, received their last update this month. Tenable adds that Extended Security Updates ended for Windows Server 2012 and 2012 R2, and that Office 2021 and Office LTSC 2021 reached end of support. If you are on 24H2, move to a newer Windows 11 version. Our Windows 11 26H2 guide explains the current release, and more Security guides cover related threats.

Frequently asked questions

Is CVE-2026-96951 being used in real attacks?

Yes. SecurityWeek reports it is exploited in the wild and was added to CISA’s Known Exploited Vulnerabilities catalog on 13 October. Details about who is using it have not been published in the sources reviewed.

Why do sources give different patch counts?

Outlets count differently. Some include fixes released earlier in October or third-party components bundled in Microsoft’s release, so totals range from about 1,407 to 1,415.

Does this affect Windows 10?

Windows 10 Enterprise 2016 LTSB reached end of support this month. Consumer Windows 10 users should check their Extended Security Updates status; see our Windows 10 security updates guide.

Do I need to do anything if Windows updates automatically?

Check that the update actually installed and restart if it is pending. Automatic updates can sit waiting for a reboot.