Microsoft has released its October 2026 Patch Tuesday security updates, addressing a record-breaking 1,411 vulnerabilities across its products, including one actively exploited zero-day and two publicly disclosed zero-day flaws.
The October security release includes 70 critical vulnerabilities, of which 57 are remote code execution flaws, 11 are elevation of privilege vulnerabilities, and two are spoofing issues. The remaining vulnerabilities cover a range of security weaknesses that could expose systems to unauthorized access, information theft, and service disruptions.
According to the vulnerability breakdown, Microsoft addressed 677 elevation of privilege flaws, 40 security feature bypass vulnerabilities, 317 remote code execution issues, 254 information disclosure flaws, 73 denial-of-service vulnerabilities, and 28 spoofing issues.
The total includes vulnerabilities Microsoft fixed as part of its October 13 Patch Tuesday release. It excludes another 348 flaws patched earlier in the month across products and services such as Azure API Center, Azure App Service, Azure Event Grid, Azure SRE Agent, Mariner, Microsoft Bookings, Microsoft Dataverse, Microsoft Exchange Server, and Microsoft Partner Center.
The record-breaking release comes as Microsoft increasingly uses artificial intelligence to identify security weaknesses in its products. As AI-assisted vulnerability discovery improves, the company expects security researchers and automated tools to uncover more flaws that require fixes.
One of the most serious vulnerabilities addressed this month is CVE-2026-96951, a Windows Shell security feature bypass flaw that Microsoft says is being actively exploited in attacks. The vulnerability involves improper handling of special elements used in commands, allowing an unauthorized attacker to bypass the Mark of the Web security feature over a network.
Mark of the Web helps Windows identify files downloaded from untrusted sources and apply additional security protections. Bypassing this mechanism could weaken protections when users open potentially dangerous files. Microsoft has not disclosed detailed information about the attacks exploiting the vulnerability or identified who reported it.
The update also fixes CVE-2026-108398, a publicly disclosed security feature bypass vulnerability affecting the .NET Framework. The flaw could allow an authenticated attacker to bypass Windows Defender Application Control restrictions and execute unauthorized code within a protected process.
According to Microsoft, an attacker could place a specially crafted .NET assembly on an affected system and register it for loading by a protected process. Successful exploitation would not require user interaction. James Forshaw of Google Project Zero discovered the vulnerability.
Another publicly disclosed flaw, tracked as CVE-2026-92707, affects MessagePack-CSharp and could allow an unauthorized attacker to trigger a denial-of-service condition over a network. The vulnerability involves improperly controlled sequential memory allocation in .NET. Microsoft has not identified who disclosed the issue.
Microsoft also announced that Windows 11 version 24H2 Home and Pro, along with Windows 10 Enterprise LTSB 2016, reached the end of support on October 13, 2026. The October security update is the final update available for these editions, meaning users should review their upgrade options to continue receiving security fixes.
Organizations running Windows 11 version 23H2 Enterprise, Education, and IoT Enterprise editions should also prepare to upgrade, as Microsoft has warned that these editions will stop receiving security updates starting in November 2026.
Alongside this month’s security fixes, Microsoft has introduced an experimental approach called risk cohorts to help organizations prioritize patches. The method groups related vulnerabilities according to the technologies and system components they affect, allowing administrators to identify areas that may need coordinated remediation.
For October, Microsoft published 15 risk cohorts. The largest groups include 136 vulnerabilities affecting Windows filesystems, storage, and backup; 135 involving Office documents and mail clients; 131 affecting Windows graphics, media, and content processing; 109 involving Windows core and kernel privilege boundaries; and 103 affecting Windows installation, deployment, and update services.
Microsoft cautions that the number of vulnerabilities in a cohort does not necessarily indicate how dangerous they are. Organizations should consider exploit activity, severity, and their own environments when deciding which updates to deploy first. The new system is intended to complement existing patching guidance rather than replace it.
Several other technology companies have also released security updates during October. Adobe issued fixes for multiple products, including Commerce, ColdFusion, Photoshop, Dimension, and other software. Atlassian addressed a critical vulnerability, CVE-2026-21589, affecting self-hosted Data Center products, including Confluence, Jira, and Bitbucket, with reports of exploitation following the release of public proof-of-concept code.
Cisco released security updates for multiple products, including critical vulnerabilities in its NX-OS networking operating system that could allow attackers to execute arbitrary code with root privileges on Nexus switches. Citrix also addressed NetScaler ADC and Gateway vulnerabilities, including CVE-2026-88779, which was reportedly exploited as a zero-day before a fix became available.
Dell patched critical vulnerabilities in its System Update command-line deployment tool and Container Storage Modules. Docker fixed a critical Docker Hub flaw that could allow attackers to impersonate users and push images to other users’ repositories. Fortinet also addressed vulnerabilities across its products, including a critical FortiMail flaw, CVE-2026-104286, reportedly exploited in zero-day attacks.
GitLab released fixes for critical vulnerabilities affecting its AI Gateway and CI/CD regular expression compiler, while Ivanti addressed an actively exploited zero-day in its Connect Secure remote-access gateway. Kiteworks patched 126 vulnerabilities, including a maximum-severity code-injection flaw in its Email Protection Gateway.
Progress Software released security updates for MarkLogic Server, while SAP addressed 20 security flaws in its October release, including a maximum-severity OAuth2 server-side request forgery vulnerability in Cloud SDK for Python. SonicWall also patched a critical server-side request forgery flaw affecting SMA1000 gateways, which attackers reportedly began exploiting shortly after disclosure.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
With thousands of vulnerabilities addressed across Microsoft’s October security releases and other vendors’ products, administrators should review the relevant advisories, install available security updates, and prioritize actively exploited flaws. Organizations should also check for unsupported Windows installations and plan upgrades to ensure their systems continue receiving security protections.
