October 2026 Patch Tuesday: over 1,400 flaws and priorities

On 13 October 2026 Microsoft released the largest monthly security update in its history: more than 1,400 vulnerabilities fixed. We covered CVE-2026-96951 in Windows Shell, the only one already exploited, in a dedicated article; here we gather the rest: the other two zero-days, the flaws worth fixing first and the Windows versions that left support on the same day.

How many, and why the numbers differ

Outlets report different totals: 1,411 according to BleepingComputer, 1,413 according to The Hacker News and Tyler Reguly of Fortra, 1,407 according to CSO Online. BleepingComputer only counts vulnerabilities published on Patch Tuesday itself and excludes 348 already fixed earlier in the month (including Azure, Dataverse and Exchange Server). Sources also disagree on critical flaws: 70 according to BleepingComputer (57 remote code execution, 11 elevation of privilege, 2 spoofing), at least 78 according to Krebs on Security.

By category, elevation of privilege (677) and remote code execution (317) dominate. Microsoft attributes the volume to the use of large language models in vulnerability research; the previous record, in September, was about 1,000.

Advisory AV26-1038 from the Canadian Centre for Cyber Security lists the affected products, among them Windows 10 and 11, Windows Server 2012 to 2025, Exchange Server, SharePoint Server, SQL Server 2017 to 2025, Office, .NET and .NET Framework. Norway’s NSM highlights no specific vulnerabilities and recommends updating as soon as possible.

The zero-days

• CVE-2026-96951, Windows Shell: the new sources clarify that the bypassed feature is Mark of the Web (MotW), the label Windows applies to files downloaded from the Internet to trigger warnings and checks. According to Krebs it affects Windows 10, Windows 11 and some Windows Server versions. Satnam Narang of Tenable, quoted by CSO Online, notes that it is the third Windows Shell flaw exploited in 2026, after CVE-2026-21510, linked to the APT28 group, and CVE-2026-32202, which fixed an incomplete patch for the former.
• CVE-2026-108398, .NET Framework (publicly disclosed, no known exploitation): an untrusted search path that allows bypassing Windows Defender Application Control (WDAC). In Microsoft’s description reported by BleepingComputer, an authenticated attacker places a specially crafted .NET assembly and registers it for loading by a protected process, gaining code execution in that process, with no user interaction. CSO Online instead speaks of an unauthenticated attacker. Discovered by James Forshaw of Google Project Zero.
• CVE-2026-92707, MessagePack-CSharp (publicly disclosed): network denial of service caused by uncontrolled memory allocation.

Sources do not agree on the list: CSO Online names SharePoint CVE-2026-102866 as the third zero-day instead of MessagePack-CSharp, while Krebs considers only the Windows Shell flaw a zero-day.

Other flaws to look at first

• SharePoint, CVE-2026-102866: elevation of privilege flagged by Dustin Childs (Zero Day Initiative). According to Microsoft, an unauthenticated attacker who obtains a valid proof token for a user can modify it, submit it to the SharePoint server and authenticate as that user, with no interaction.
• 55 wormable vulnerabilities, again according to Childs: no authentication and no click, concentrated among others in DHCP Server (6), Remote Desktop Gateway (3) and Network Policy Server (4).
• CVSS 9.8, no authentication or interaction (Jack Bicer, Action1): Message Queuing CVE-2026-100202, PostScript printer driver CVE-2026-70147 and CVE-2026-70153, QUIC CVE-2026-105016 and CVE-2026-100219. No confirmed exploitation.
• Exchange Server: four on-premises updates, each with a CVSS 8.8 vulnerability (Nightwing).

Microsoft is experimentally introducing risk cohorts: 15 groups of related vulnerabilities, from file systems and backup (136) to Office documents and mail clients (135), with a mapping PDF. Microsoft stresses that they do not, on their own, indicate the most dangerous flaws.

Windows versions with no more updates

October’s release is the last update for Windows 11 24H2 Home and Pro and for Windows 10 Enterprise LTSB 2016. The Enterprise and Education editions of 24H2 remain supported until 12 October 2027. From November, Windows 11 23H2 Enterprise, Education and IoT Enterprise also stop receiving updates; Windows Server 2022 leaves mainstream support but stays in extended support until October 2031. Microsoft points to an upgrade to Windows 11 26H2. For Windows 10 with ESU or LTSC the update is KB5126657 (builds 19045.7807 and 19044.7807).

Impact for European and Italian companies

Many small and medium businesses run Windows 11 Pro: workstations still on 24H2 will receive no fixes from November. For NIS2 entities, vulnerability management requires justified priorities: with volumes like these, the criterion indicated by the experts quoted is real-world exploitation. Reguly notes that only 26 Microsoft CVEs from 2026 are in CISA’s KEV catalogue. In healthcare, DHCP servers, remote desktop gateways and NPS are often shared with clinical networks: treat them as exposed systems.

What to do now

1. Windows Shell first (CVE-2026-96951), as in the previous article: it is the only one already exploited and it bypasses Mark of the Web protections.
2. Exposed or central services: SharePoint, Remote Desktop Gateway, DHCP Server, NPS, Message Queuing and on-premises Exchange, starting with those reachable from the Internet.
3. If you use WDAC for application control, update .NET Framework as a priority: CVE-2026-108398 is already public.
4. Version inventory: find workstations running Windows 11 24H2 Home or Pro and plan the move to 26H2; by November, prepare those on 23H2 Enterprise and Education.
5. Priorities: start with CVEs in the KEV catalogue, then use risk cohorts to organise testing and rollout; finally, check that the installation succeeded on every machine.

How ARXDOME helps

ARX Shield shows open vulnerabilities by machine and by package and highlights those already exploited by attackers, helping decide the order of updates. ARX Sentry collects the system and software inventory of computers and servers, useful for finding workstations on out-of-support Windows versions. ARX Expose shows which services your company exposes on the Internet, such as a remote desktop gateway or a SharePoint portal.

Last updated: 14 October 2026