Microsoft’s October 2026 Patch Tuesday addresses 1407 CVEs (CVE-2026-96951)
Microsoft’s October 2026 Patch Tuesday fixes 1,407 CVEs, including an exploited Windows Shell zero-day.
Microsoft’s October 2026 Patch Tuesday fixes 1,407 CVEs across 301 products, including 69 critical and 1,337 important issues, with elevation of privilege and remote code execution the largest categories. CVE-2026-96951, a Windows Shell Mark of the Web bypass scored 8.8, was exploited in the wild; CVE-2026-108398, a .NET Framework control bypass, was publicly disclosed. Critical bugs include Active Directory Domain Services RCE CVE-2026-70229 and Exchange RCE CVE-2026-70571, both rated exploitation more likely. Extended Security Updates for Windows Server 2012 and 2012 R2 ended on October 13.
82