October Patch Tuesday: 1,413 Fixes, One Zero-Day
Microsoft’s October 2026 Patch Tuesday landed on 13 October with 1,413 security fixes, 75 of them rated Critical. One is already being exploited.
Patch first: the exploited zero-day
CVE-2026-96951, Windows Shell (CVSS 8.8). Microsoft has confirmed attacks in the wild. It bypasses Mark of the Web, the warning Windows shows before you open a file downloaded from the internet. That makes malicious attachments and downloads more likely to run without a prompt.
Two further flaws were publicly disclosed before a fix was available:
- CVE-2026-108398, .NET Framework (CVSS 8.8): bypasses Windows Defender Application Control (WDAC) enforcement.
- CVE-2026-92707, MessagePack-CSharp (CVSS 5.3): denial of service.
Also high on the list
- Outlook: five remote code execution flaws rated 9.8. Two can be triggered through the Preview Pane, so a user only needs to view an email.
- Office: 20 remote code execution flaws, led by PowerPoint (CVE-2026-88178, 9.8). There are 23 Preview Pane issues across Excel, PowerPoint and Visio in total.
- Network-facing services: 15 flaws an attacker can exploit remotely without logging in, including DHCP Server, QUIC, Message Queuing and the PostScript printer driver.
- Servers: Exchange, SharePoint, Remote Desktop Services, Active Directory Domain Services and Hyper-V all have fixes scoring 7.2 to 8.8.
- Raw Image Extension: this update comes through the Microsoft Store, so check it installs where Store access is restricted.
Two dates that matter this month
- Windows 11 24H2 (Home and Pro) reached end of servicing on 13 October. This release is its last security update. See our 24H2 end-of-life post.
- Windows 10 devices only receive these fixes through Extended Security Updates (ESU). ESU accounts for 977 of this month’s patches.
What to do
- Patch the Windows Shell zero-day now, along with Outlook and Office, on every device.
- Prioritise internet-facing servers: DHCP, Exchange, Remote Desktop and anything else exposed.
- Move any 24H2 Home or Pro devices to 25H2 or later.
- Check your update reports, not just the policy. Devices that are offline, deferred or Store-restricted are where gaps hide.
Cyber Essentials requires high and critical security updates to be installed within 14 days. With patch volumes this high, that window is a maximum, not a target. Why 14 days is no longer enough.
Bottom line: patch the zero-day today and the rest well inside 14 days.
Need to certify? See our remote Cyber Essentials and Cyber Essentials Plus assessments or 📧 contact us.