Microsoft’s October 2026 Patch Tuesday fixes 1,411 flaws, including 3 zero-days

Microsoft’s October 2026 Patch Tuesday updates fix 1,411 vulnerabilities, including one that was actively exploited and two that had been publicly disclosed. BleepingComputer reports that the total counts vulnerabilities released on Patch Tuesday itself and excludes 348 flaws fixed earlier in October.

The updates address 70 critical vulnerabilities: 57 remote code execution flaws, 11 privilege escalation flaws and 2 spoofing flaws. Microsoft did not provide details on how attackers exploited the actively exploited zero-day, CVE-2026-96951, a Windows Shell security feature bypass that could circumvent Mark of the Web.

The two publicly disclosed flaws are CVE-2026-108398 in .NET Framework and CVE-2026-92707 in MessagePack-CSharp. Microsoft says the .NET Framework vulnerability could let an authenticated attacker bypass Windows Defender Application Control restrictions and run code within a protected process. Google Project Zero’s James Forshaw discovered it. The MessagePack-CSharp flaw is a denial-of-service vulnerability; Microsoft did not identify its discoverer.

Microsoft also said October 13, 2026, was the final update date for Windows 11, version 24H2 Home and Pro, and Windows 10 Enterprise LTSB 2016. The company said those editions would receive no further updates.