Microsoft’s October 2026 Security Update Fixes 1,411 Vulnerabilities, Including Three Zero-Days

Microsoft’s October security release became one of the company’s largest Patch Tuesday updates, with 1,411 vulnerabilities addressed in the count reported by BleepingComputer. Other security trackers reported slightly different totals because of differences in how vulnerabilities and related updates are counted.The fixes span a broad range of Microsoft technologies, including Windows, Office, developer tools, SharePoint Server, Azure and other enterprise products. The vulnerabilities vary in severity and potential impact, from unauthorised access and privilege escalation to remote code execution and denial-of-service attacks.According to BleepingComputer’s tally, 70 vulnerabilities were rated critical. Of these, 57 involved remote code execution, a category that can allow attackers to run malicious code on affected systems under the conditions described in each vulnerability.The raw number is significant, but it does not mean that every affected system is equally vulnerable or that all flaws are being exploited. Actual risk depends on the product in use, its configuration, exposure to the internet and whether attackers have developed a working exploit.

Three Zero-Days Put Security Teams on Alert

The October release addressed three zero-day vulnerabilities. In this context, a zero-day refers to a flaw that was publicly disclosed or exploited before an official security fix became available. Microsoft’s release included one vulnerability confirmed as actively exploited and two that had been publicly disclosed.The distinction matters: public disclosure increases the urgency of remediation, but it does not by itself prove that attackers are exploiting a flaw in the wild.

1. CVE-2026-96951: Windows Shell security bypass

The most urgent issue was CVE-2026-96951, a Windows Shell security-feature bypass vulnerability that Microsoft identified as actively exploited.The flaw affects the Mark of the Web security mechanism, which helps Windows identify files obtained from potentially untrusted sources, such as the internet. These markings can trigger additional security checks or warnings when users open downloaded content.A successful exploit could bypass this protection under the relevant conditions, potentially making it easier for malicious content to evade a security barrier. Microsoft’s public description does not provide a complete account of the observed attack methods.Because exploitation had already been reported, organisations should prioritise this fix when assessing their October patching requirements.

2. CVE-2026-108398: .NET Framework security bypass

The second vulnerability, CVE-2026-108398, affects the .NET Framework and involves an untrusted search-path issue.Under certain conditions, an authenticated local attacker could place a specially crafted .NET assembly where a protected process might load it. Successful exploitation could allow the attacker to bypass Windows Defender Application Control restrictions and execute code within that process.Google Project Zero researcher James Forshaw was credited with discovering the flaw. It was publicly disclosed, but the available reporting did not establish that it was actively exploited in the wild.

3. CVE-2026-92707: MessagePack-CSharp denial of service

The third vulnerability, CVE-2026-92707, affects MessagePack-CSharp, a library used for serialising and deserialising data in .NET applications.The flaw involves inadequately controlled sequential memory allocation. Under the relevant conditions, an attacker could cause a denial-of-service condition by consuming excessive resources, disrupting an affected service.Although denial-of-service vulnerabilities do not necessarily provide access to confidential information, service interruptions can affect application availability and business operations.This vulnerability was also publicly disclosed. It should not be described as confirmed actively exploited based on the available evidence.

Why the Vulnerability Count Matters

A large patch release creates an operational challenge for IT teams. Organisations must identify which products they run, determine which updates apply, assess compatibility and deploy fixes without unnecessarily disrupting business operations.The October release included hundreds of vulnerabilities involving elevation of privilege and remote code execution. Privilege escalation can allow an attacker with an initial foothold to obtain greater access, while remote code execution can permit malicious instructions to run on a target system.These categories can combine during an attack. For example, an attacker may use one weakness to gain an initial foothold and another to increase privileges. However, the presence of multiple vulnerabilities in a monthly release does not mean they can automatically be chained together.Microsoft also introduced experimental risk cohorts to group related vulnerabilities and help organisations assess patching priorities. The groups are intended to support triage, not replace assessments based on confirmed exploitation, severity and the systems an organisation actually operates.

What About Azure and Other Microsoft Services?

The October security release covered more than Windows alone. Microsoft products and services across its wider ecosystem received fixes, including Azure-related components and enterprise software.However, the headline total should not be interpreted as 1,411 vulnerabilities affecting every Microsoft product, or as 1,411 flaws in Azure specifically. Each vulnerability has its own affected-product list and remediation guidance.Cloud customers should establish whether a vulnerability affects a service they manage directly, a component maintained by Microsoft or software deployed within their own cloud environment. Responsibility for applying a fix may differ accordingly.Businesses should also review the security status of servers, developer tools and collaboration platforms rather than concentrating exclusively on desktop Windows updates.

What Users and Organisations Should Do

Security teams should use Microsoft’s Security Update Guide and the relevant product advisories to identify applicable updates. The first priority should be the actively exploited Windows Shell vulnerability, followed by other patches based on exposure, severity and operational risk.Organisations should test updates where necessary, deploy them through established patch-management processes and confirm that installation succeeded. Internet-facing services and systems that handle sensitive information warrant particular attention.Users should install available Windows and Office updates, restart devices when required and avoid opening unexpected attachments or downloads. Organisations running older or unsupported software should also assess upgrade options because routine security fixes may no longer be available.Patching reduces exposure to known vulnerabilities, but it cannot guarantee that a system is free from compromise. Where suspicious activity is detected, security teams should preserve relevant logs and investigate whether an attacker gained access before the fix was installed.

A Reminder That Speed Matters in Cybersecurity

FAQs1. How many vulnerabilities did Microsoft fix in October 2026?BleepingComputer counted 1,411 vulnerabilities in the October 13 Patch Tuesday release. Other trackers reported slightly different totals because of differences in counting methods.2. Were all three zero-day vulnerabilities actively exploited?No. One, CVE-2026-96951, was confirmed as actively exploited. The other two were publicly disclosed, but the available reporting did not establish active exploitation.3. What is CVE-2026-96951?It is a Windows Shell security-feature bypass vulnerability affecting Mark of the Web protections for potentially untrusted files.4. Did the update affect Azure?The broader October release included Azure-related components alongside Windows, Office, developer tools and other Microsoft products. The specific products affected vary by vulnerability.5. What should users do to protect their systems?Install applicable security updates, restart devices when required, verify that updates were successful and follow official guidance for any affected products. Organisations should prioritise vulnerabilities confirmed as exploited.