Security · October 16, 2026
Microsoft patches 1,407 vulnerabilities in October 2026 update
Microsoft released its monthly security updates on October 13, 2026, addressing a total of 1,407 vulnerabilities. This release includes fixes for three zero-day flaws, one of which is already being exploited in the wild. The update marks the final security patch for several editions of Windows and Windows Server.
The October release significantly exceeds the previous monthly record, surpassing the 973 vulnerabilities patched in September 2026 by more than 400. Microsoft attributes the increasing volume of patches to the use of artificial intelligence for vulnerability research. The Windows operating system accounts for 1,115 of the fixed flaws, followed by Microsoft Office with 138, SharePoint Server with 36, SQL Server with 22, and Exchange Server with 6. Of the total, 672 vulnerabilities allow privilege escalation and 314 enable remote code execution, with 69 classified as critical.
Among the notable fixes is CVE-2026-96951, a command injection flaw in Windows Shell with a CVSS score of 8.8. This vulnerability allows attackers to bypass the Mark of the Web protection, which triggers SmartScreen warnings for downloaded files. Microsoft notes that an attacker could send a specially crafted file via email or instant message, requiring the user to open the attachment or click a link. The flaw affects Windows 10, Windows 11 versions 23H2 through 26H2, and Windows Server 2012 R2 through 2025.
Another significant fix is CVE-2026-108398, a .NET Framework vulnerability with a CVSS score of 8.8 that allows bypassing Windows Defender Application Control, now known as App Control for Business. An authenticated attacker can place a specially crafted .NET assembly on an affected system to execute code within a protected process. This requires local access and is fixed by updating the .NET Framework regardless of the Windows version.
The third zero-day, CVE-2026-92707, is a denial-of-service flaw in the MessagePack-CSharp serialization library. With a CVSS score of 5.3, it results from uncontrolled sequential memory allocation and can be exploited remotely without authentication. This vulnerability affects Windows, Linux, and macOS systems if the vulnerable component is present.
To help IT teams prioritize deployments, Microsoft introduced risk cohorts, a method that groups Common Vulnerabilities and Exposures based on specific environmental criteria, such as Remote Desktop Protocol server exposure. This October update also serves as the final security release for multiple versions of Windows and Windows Server, depending on the edition.