October Patch Tuesday: 1,408 CVEs, 1 exploited flaw and a SharePoint surprise
Microsoft’s October 2026 Patch Tuesday is the year’s largest release, with 1,408 CVEs requiring customer action, 72 of them rated critical. September, the previous high, carried 963. One CVE is already exploited: CVE-2026-96951 , a Windows Shell flaw that bypasses Mark of the Web. Two were publicly disclosed before release, in the .NET Framework and the MessagePack-CSharp library. Separately, on…
Microsoft's October 2026 Patch Tuesday is the largest release of the year, containing 1,408 CVEs that require customer action, with 72 of them rated critical. September's previous high was 963 CVEs. One CVE, CVE-2026-96951, is already exploited, affecting Windows Shell. Two CVEs were disclosed before the release: one in .NET Framework and another in MessagePack-CSharp library.
Separately, on September 25, Microsoft reported attacks against CVE-2026-65660, a SharePoint Server flaw fixed in August. Microsoft recommends scheduling a patch now for Windows, Office, Exchange, and developer tooling, while suggesting a standard release schedule for SQL Server. The Readiness team published an infographic showing deployment risk by product family.
On October 14, Microsoft added a known issue to Windows 11 updates, affecting versions 24H2, 25H2, and 26H2, as well as 26H1. Non-admin users may face issues opening Remote Desktop connections to Administrator-protected devices. Microsoft advises turning off Administrator protection temporarily and expects a fix in a future update.
Two issues remain open: USB Audio Class 1.0 devices failing to start or produce sound, and Windows Server Update Services not displaying synchronization error details on Server 2025 and Server 2022. Three issues are now closed, including the incorrect "Microsoft Defender Antivirus is turned off" notifications and a File History backup/restore issue on Windows 11, 10, 11 23H2, and Server 2016 and 2019.
Between September and October, 111 security update guide notifications covered Microsoft's own products, with 90 revisions rather than new entries. Between September 9th and October 12th, Microsoft corrected three critical SQL Server remote code execution flaw scores to state that attackers require no privileges. Microsoft also revised CVE-2026-65660 to confirm observed attacks against it.
Of the 21 new entries, 18 are critical cloud-side flaws in Azure, Microsoft 365 Copilot, Dataverse and Fabric. Microsoft has not provided mitigations or workarounds for these. Windows lifecycle and enforcement updates passed with this release, including the end of support for Office 2021 retail and Office LTSC 2021, Windows 10 Enterprise 2016 LTSB, and Windows 10 IoT Enterprise LTSB 2016.
Extended Security Updates for Windows Server 2012 and 2012 R2 also ended. Windows 11 Home and Pro version 24H2, Windows Server 2022, and several other products reached the end of updates, marking the last update for these editions.
Written by urgent.news from Computerworld's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
