The October Microsoft Patch Tuesday security updates for 2026 brought a record number of fixes. PCWorld reports 1,416 fixed vulnerabilities, while Infosecurity Magazine, BleepingComputer and ITdaily all cite 1,411. According to PCWorld, this is the first month in which Microsoft surpassed a thousand fixes, and at the same time more flaws than the company removed in all of 2025 (a little over 1,100).
Newsrooms also differ on the number of critical flaws. PCWorld counted 85, of which 67 were remote code execution (RCE). Infosecurity Magazine and ITdaily report 70 critical vulnerabilities and 57 RCEs among the critical ones, respectively.
What Microsoft Patch Tuesday brought in October 2026
The fixes cover Windows, Office, Exchange Server, SQL Server, Hyper-V, Skype for Business, Microsoft Defender,.NET Framework, Visual Studio and Microsoft cloud services. According to PCWorld, Microsoft marked 42 flaws in Windows as critical, 30 of them RCE. In Office products it fixed 194 vulnerabilities, including 25 critical RCEs, and in Exchange Server seven flaws, among them the critical RCE CVE-2026-70571. A critical privilege escalation flaw, CVE-2026-102866, is also present in SharePoint and, according to PCWorld, can be exploited without a user logging in.
Infosecurity Magazine highlighted the RCE flaw CVE-2026-70242 in the Outlook preview pane with a CVSS score of 9.8. Automox said of it: "A carefully crafted email triggers a heap buffer overflow the moment Outlook renders it in the preview pane. The recipient doesn't open the message or click anything. No authentication, no user interaction."
According to Infosecurity Magazine, the rise in the number of flaws is linked to the deployment of artificial intelligence, specifically the MDASH technology for multiple scanning. The Microsoft Edge 155.0.4283.45 update of 8 October addresses 247 flaws in Chromium, which are not counted in the overall total.
Exploited vulnerability CVE-2026-96951
One of the fixes is already being exploited by attackers in the wild. The flaw CVE-2026-96951 in Windows Shell bypasses the Mark of the Web protection and makes it possible to disguise the origin of an executable file from the internet. According to Infosecurity Magazine, it has a CVSS score of 8.8, low attack complexity and requires neither authentication nor prior privileges. Jack Bicer, director of vulnerability research at Action1, said: "Attackers can distribute specially crafted files through phishing emails, instant messages or malicious websites, with only user interaction needed for exploitation."
Two other flaws were publicly known before the update was released: CVE-2026-108398 (bypassing a.NET Framework security feature) and CVE-2026-92707 (denial of service in MessagePack-CSharp).
End of support for Windows 11 24H2
According to ITdaily, Windows 11 24H2 Home and Pro received their last security update and will get no further ones. PCWorld recommends upgrading to Windows 11 25H2 or 26H2. Windows Enterprise LTSB 2016 also received its last update, and support for Windows 11 23H2 Enterprise and Education will end after next month. The update for Windows 11 is designated KB5127646.
PCWorld states that the Windows 10 extended support program has been extended to 12 October 2027, while according to ITdaily individuals can use Windows 10 without paying for security updates until October 2027.
According to research by Socura, 22 percent of British chief information security officers (CISOs) took sick leave or vacation to avoid Patch Tuesday. The next Patch Tuesday is scheduled for 10 November 2026.