Microsoft's October 2026 Patch Tuesday fixes a record 1,411 flaws, including an actively exploited zero-day

TLDR

• Microsoft's October 2026 Patch Tuesday fixes 1,411 vulnerabilities, its largest monthly release yet.¹
• Defenders must triage an actively exploited zero-day inside a release far larger than a typical Patch Tuesday.¹
• The priority fix is CVE-2026-96951, a Windows Shell bypass already exploited before the patch.¹²³

Today's release addresses 677 elevation-of-privilege bugs, 317 remote-code-execution flaws, 254 information-disclosure issues, 73 denial-of-service bugs, 40 security-feature bypasses and 28 spoofing vulnerabilities, on top of 348 flaws Microsoft had already patched earlier this month outside the main Patch Tuesday batch.¹ Of the 70 Critical-rated flaws, 57 allow remote code execution.¹ Microsoft also confirmed that Windows 11 version 24H2 Home and Pro, along with Windows 10 Enterprise LTSB 2016, reached end of support today, meaning this month's updates are the last these editions will receive.¹

Researchers at Zero Day Initiative and Dark Reading both flagged the actively exploited Windows Shell bypass, CVE-2026-96951, as the priority fix this cycle, noting Microsoft has not disclosed how it was discovered or exploited in the wild.²³ The .NET Framework bypass could let an authenticated attacker register a malicious assembly to run inside a protected process and sidestep Application Control restrictions without user interaction.¹

Why it matters: a four-figure monthly flaw count, driven partly by Microsoft's own AI-assisted bug-hunting, means defenders now have to triage an actively exploited zero-day inside a release an order of magnitude larger than a typical Patch Tuesday from just a few years ago.