The short version
Microsoft's October 2026 Patch Tuesday fixes over 1,400 vulnerabilities and one exploited zero-day, CVE-2026-96951, a Windows Shell bug that strips Mark of the Web from malicious files. CISA gave federal agencies until October 16 to patch it. A second, publicly disclosed flaw (CVE-2026-108398) lets attackers bypass Windows Defender Application Control through the .NET Framework — a direct concern for teams that rely on allow-listing to lock down .NET line-of-business apps. Microsoft also launched experimental “risk cohorts” to help prioritize.
What did Microsoft ship on October 13?
Microsoft's October release is the biggest Patch Tuesday ever, again. Tenable counted 1,407 CVEs across 301 products and components, with 69 rated Critical; BleepingComputer's tally came to 1,411, including 70 Critical. As in previous months, the counts differ because outlets fold bundled third-party and browser advisories in differently. Elevation of privilege makes up nearly half the batch (677 bugs by BleepingComputer's count) and remote code execution another 317.
Only one of those flaws is confirmed exploited in the wild: CVE-2026-96951 in Windows Shell. Two more were publicly disclosed before the fix: CVE-2026-108398, a .NET Framework security-feature bypass, and CVE-2026-92707, a memory-allocation denial-of-service bug in the open-source MessagePack-CSharp library. On the server side, the critical remote-code-execution bugs in Active Directory Domain Services (CVE-2026-70229) and Exchange Server (CVE-2026-70571) deserve early attention, because both sit at the heart of most corporate networks.
Microsoft was not alone. The same day, Adobe, Atlassian, Cisco, Citrix, Fortinet, GitLab, Ivanti, SAP, SonicWall and others shipped their own fixes, and CISA's October 13 KEV update paired the Windows bug with an exploited Ivanti Connect Secure authentication bypass (CVE-2026-104935). For most IT teams this is a full-stack patch week, not just a Windows one.
Why does the Shell zero-day matter?
Mark of the Web is the quiet flag Windows attaches to anything that arrives from the internet. It is what makes SmartScreen warn before an unknown executable runs and what opens downloaded Office documents in Protected View. CVE-2026-96951 is a command-injection flaw in Windows Shell that lets a crafted file, delivered by email, chat or a link, open without that flag being honored. Microsoft rates it Important with a CVSS of 8.8, and it affects Windows 10, Windows 11 and Windows Server 2012 R2 through 2025.
MotW bypasses rarely look dramatic on a severity chart, yet they keep turning up in real intrusions because they remove the last warning a user sees before running a malicious attachment. That is why CISA moved quickly: the bug entered the KEV catalog on release day with a three-day remediation deadline for federal civilian agencies. For private companies the lesson is about placement. This is an endpoint and user-facing risk, so finance and HR laptops that open outside documents all day are a higher priority than a locked-down server.
The .NET bug is a different kind of problem. CVE-2026-108398 lets an attacker get around Windows Defender Application Control, the allow-listing layer many regulated organizations use to make sure only approved code runs. It is not known to be exploited, but it was public before the patch, and a researcher of Forshaw's profile tends to attract follow-on work. If your hardening story for auditors leans on WDAC, this one belongs in the same week as the zero-day.
What are risk cohorts, and do they help?
Along with the fixes, Microsoft introduced an experimental way to read them. Instead of one flat list, the month's vulnerabilities are grouped into 15 “risk cohorts” that share exposure characteristics and remediation steps — for example Office documents and mail clients, Windows filesystems, storage and backup, Windows graphics and media processing, or kernel privilege boundaries. Each cohort maps roughly to a team or a class of systems that will do the patching.
Microsoft is careful to say the cohorts are a planning aid, not a ranking. A big cohort is not automatically a dangerous one; actual priority still depends on exploitation status, severity and how your organization uses the affected software. That caveat matters. The cohort with the most CVEs this month is not the one holding the exploited Shell bug, and a team that patches by cohort size alone would get the order wrong.
Still, the change is a sign of where vulnerability management is heading. With AI-assisted discovery pushing monthly totals from hundreds to well over a thousand, reading each advisory is no longer realistic. Grouping by “who has to act and on what” is a sensible bridge between Microsoft's raw feed and an organization's own asset inventory — provided you still overlay the exploited and disclosed bugs on top.
What just went out of support?
October is also a lifecycle month. According to Tenable and BleepingComputer, Office 2021, Office LTSC 2021 and Skype for Business LTSC 2021 have reached end of support, as have Windows 11 version 24H2 Home and Pro and Windows 10 Enterprise LTSB 2016. Extended Security Updates for Windows Server 2012 and 2012 R2 have ended, and Windows Server 2022 has left mainstream support for extended support, which runs until October 2031.
End-of-support dates matter more than they used to, because the volume problem compounds on unsupported systems. A machine that stops receiving fixes in a month with 1,400 CVEs falls behind quickly, and next month's patch notes will quietly describe its weaknesses to anyone who reads them. Windows 11 23H2 Enterprise and Education editions are next in line, losing security updates in November.
What it means for US & EU teams
First, aim the urgent work at people rather than perimeters. The exploited bug of the month rides in on attachments and links, so the speed of your endpoint patch rollout — and your ability to prove it landed on remote and contractor machines — is the real control. Pair it with mail-gateway rules that strip or sandbox the file types attackers are using for MotW bypasses.
Second, treat application-control bypasses as a compliance issue, not only a security one. Many SOC 2, PCI DSS and NIS2-scoped environments document allow-listing as a compensating control. A public WDAC bypass weakens that claim until the .NET update is deployed, so the fix belongs in your evidence trail as well as in your change log.
Third, use Microsoft's cohorts to rethink how patch work is routed. If each cohort has a named owner — endpoint, identity, mail, storage, developer runtimes — a 1,400-CVE month becomes fifteen manageable queues instead of one wall of noise. Companies that run critical Windows and .NET estates without a dedicated security bench often get the most from a short external review: confirming what is actually exposed, which controls auditors rely on, and where unsupported systems are hiding.
A patch-first checklist
- Endpoints first. Push the October cumulative update to all Windows 10/11 machines that open external files — CVE-2026-96951 is exploited and phishing-delivered.
- Close the WDAC gap. Deploy the .NET Framework update for CVE-2026-108398 wherever application control is part of your security or audit story.
- Protect identity and mail. Prioritize domain controllers (CVE-2026-70229) and on-premises Exchange (CVE-2026-70571).
- Check the rest of the stack. Ivanti Connect Secure (CVE-2026-104935, KEV) plus same-day fixes from Cisco, Fortinet, Citrix, SAP, GitLab and others.
- Route by cohort, rank by exploitation. Assign each of Microsoft's 15 cohorts an owner, but sort the queue by exploited, disclosed and internet-reachable first.
- Retire or isolate end-of-support systems. Office 2021, Windows 11 24H2 Home/Pro, Windows Server 2012/2012 R2 without ESU.
Frequently asked questions
How many vulnerabilities did Microsoft fix in October 2026?
Microsoft's October 13, 2026 Patch Tuesday is the largest on record. Tenable counted 1,407 CVEs (69 Critical) and BleepingComputer 1,411 (70 Critical); the gap comes from how bundled third-party and browser advisories are counted. Elevation of privilege is close to half of the total and remote code execution a little over a fifth.
Which October 2026 zero-day is actively exploited?
CVE-2026-96951, a command-injection flaw in Windows Shell rated CVSS 8.8, is exploited in the wild. It lets a crafted file delivered by email, chat or a link skip Mark of the Web, the internet-origin flag that triggers SmartScreen and Office Protected View. CISA added it to the Known Exploited Vulnerabilities catalog on October 13 with an October 16 deadline for federal agencies.
What are Microsoft's new risk cohorts?
Risk cohorts are an experimental grouping Microsoft introduced with the October 2026 release: the month's vulnerabilities are sorted into 15 buckets that share exposure characteristics and remediation steps, such as Office documents and mail clients or Windows filesystems, storage and backup. Microsoft says the cohorts help planning but do not by themselves indicate which flaws are most dangerous; exploitation status, severity and your own exposure still decide priority.
What reached end of support with the October 2026 update?
According to Tenable and BleepingComputer, October 2026 marks end of support for Office 2021 and Office LTSC 2021, Windows 11 version 24H2 Home and Pro, Windows 10 Enterprise LTSB 2016, and the end of Extended Security Updates for Windows Server 2012 and 2012 R2. Windows Server 2022 leaves mainstream support and moves to extended support through October 2031.
Sources
BleepingComputer — Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days (October 13, 2026)
Dark Reading — Zero-Days Lurk in Microsoft's Overgrown October Patch Tuesday (October 2026)
Tenable — Microsoft's October 2026 Patch Tuesday Addresses 1,407 CVEs (October 13, 2026)
CISA — CISA Adds Two Known Exploited Vulnerabilities to Catalog (October 13, 2026)