Microsoft Patch Tuesday, October 2026 Security Update Review
Microsoft's October 2026 Patch Tuesday fixes 1,414 flaws, including exploited Windows Shell bypass CVE-2026-96951.
Qualys reviews Microsoft's October 2026 Patch Tuesday, its largest release, covering 1,414 vulnerabilities including 78 critical and 1,329 important issues. Two zero-days are patched; CVE-2026-96951, a Windows Shell security-feature bypass reachable over the network, is actively exploited and was added to CISA's Known Exploited Vulnerabilities catalog, with patching urged before October 16, 2026. CVE-2026-108398 is a local .NET Framework security-feature bypass. Critical fixes include unauthenticated remote code execution in Microsoft QUIC, Exchange Server, Windows Message Queuing, Media Foundation, and related Windows components.