October Patch Tuesday 2026: What to Patch First

Facts verified October 15, 2026.

Microsoft’s October Patch Tuesday 2026 landed on October 13 with a headline number so big it is almost useless: 1,413 CVEs. Ignore the number. What matters is the short list of things that can actually hurt you: one exploited zero-day with a remediation deadline of tomorrow, a cluster of network-reachable remote code execution flaws, and a handful of updates that change what your dev machine and your servers must be running tonight. Here is what to actually patch, in the order it matters.

Table of Contents

The 1,413 number is the least useful part of the release

Yes, 1,413 Microsoft CVEs is a record — the second consecutive record month after September’s ~974. For context, October alone exceeds every full year before 2026: the whole of 2025 had roughly 1,100 CVEs, and the previous full-year record was 2020’s 1,261. The year-to-date count for 2026 is past 4,000, with the trajectory looking like June’s 206, July’s 569, August’s ~398, September’s ~974, and now October’s 1,413. Tenable’s Satnam Narang notes it is more than double the previous record-setting year with three months still to go.

A few honest caveats on the counts, because trackers disagree slightly: BleepingComputer counted 1,411 (excluding fixes published earlier in October), Tenable 1,407, Action1 1,409, SANS 1,417. The MSRC figure is 1,413 Microsoft CVEs; the 1,414 total you may see elsewhere includes one republished non-Microsoft CVE (Cisco Talos’s CVE-2026-21413, a Raw Image Extension heap-buffer-overflow RCE). Critical counts range from 69 to 80 depending on who is counting.

Why does any of this matter less than it sounds? Because of what is driving the count: AI-assisted vulnerability discovery at a scale nobody planned for. MSVP Engineering’s Tom Gallagher described it in June 2026 as discovery at “speed and scale previously unseen.” And here is the triage statistic Fortra’s Tyler Reguly points at: only 26 of the 4,000+ CVEs Microsoft patched this year have landed in the CISA Known Exploited Vulnerabilities catalog. Less than 1% of what Microsoft patched in 2026 is known to be exploited. The dev.to recap of the release put it best: the record number is the least useful thing in the release. So forget the volume — patch the exploited one first, the network-reachable ones second, and everything else by risk cohort.

Tonight’s job: patch CVE-2026-96951 (the exploited one)

The one thing on this month’s list that is confirmed being exploited in the wild is CVE-2026-96951, a Windows Shell security feature bypass rated CVSS 8.8 (Microsoft severity: Important).

What it is: an “improper neutralization” flaw that lets an attacker bypass the Mark of the Web over a network — MOTW is the mechanism Windows uses to tag files downloaded from the internet so that Office and the OS treat them with suspicion. Bypass it, and a crafted file that should have triggered “this came from the internet” warnings does not. Microsoft describes the weakness as a command-injection-style bypass: an unauthorized attacker can neutralize the special elements MOTW relies on, and the crafted file needs to be opened by the victim — user interaction is required.

Why it should matter to you specifically: you download installers, SDKs, random GitHub release binaries, and Stack Overflow-adjacent tooling all day. MOTW is one of the few things standing between your reflex to double-click a downloaded setup file and whatever came bundled with it. With the bypass actively exploited, that layer of the onion is unreliable until you patch.

The backstory is also a warning: this is the third exploited Windows Shell flaw of 2026. CVE-2026-21510 in February (linked to APT28) was followed in April by CVE-2026-32202 — which turned out to be an incomplete fix for the February one. The October flaw was reported to Microsoft by researchers at Fujitsu and Anthropic, alongside an independent researcher.

The part with a clock on it: CISA added CVE-2026-96951 to its Known Exploited Vulnerabilities catalog on October 13, with a federal remediation deadline of October 16, 2026 under Binding Operational Directive 22-01. Federal agencies have to be patched by tomorrow. You are not a federal agency, but when the exploited flaw has a published deadline measured in hours, that is your patch order being decided for you: this one first, tonight.

Next: the network-reachable Criticals

After the exploited zero-day, the next tier is the flaws attackers can reach without phoning you first. The recurring theme from every analyst this month: patch internet-facing systems early.

Windows Message Queuing RCEs. CVE-2026-108460 is a use-after-free remote code execution flaw in MSMQ, rated CVSS 8.1 and Critical by the Zero Day Initiative; Cisco Talos confirms the weakness class. Right next to it sits CVE-2026-100202, an MSMQ Queue Manager RCE rated Critical at CVSS 9.8. MSMQ is one of those components people enable and forget — audit whether it is running on anything reachable and patch it.

The zero-click cluster. Fortra’s Dustin Childs flags 55 unauthenticated zero-click flaws this month across DHCP Server, RD Gateway, and Network Policy Server components — “the highest lateral propagation risk in years.” Zero-click means no victim interaction at all; the attacker just sends network traffic. If you run Windows servers with DHCP or RD Gateway exposed anywhere, these go in tier two with the MSMQ pair.

Also worth naming this month: five Outlook remote code execution flaws at CVSS 9.8 with a reading-pane attack vector (CVE-2026-70242, CVE-2026-97016, CVE-2026-88156, CVE-2026-70291, CVE-2026-97749) — the reading-pane vector means previewing the message can be enough; an unauthenticated SharePoint elevation-of-privilege flaw (CVE-2026-102866); an Exchange Server RCE (CVE-2026-70571); Hyper-V host RCEs (CVE-2026-102214, CVE-2026-105733); and Active Directory flaws including an AD DS RCE (CVE-2026-70229) and NDES RCE (CVE-2026-69802). The product split tells the story of where to look: Windows 1,102, Office 134, Developer Tools 61, SharePoint Server 36, SQL Server 22, Azure 15, Exchange Server 7, Defender 4, with the remainder in other products.

The publicly disclosed pair: patch, don’t panic

Beyond the exploited flaw, two more CVEs were publicly disclosed before Microsoft patched them. Depending on whose definition of “zero-day” you use, this month has either two zero-days (the exploited one plus one disclosed) or three (one exploited plus two disclosed). Microsoft’s own definition counts anything publicly disclosed or exploited before a fix as a zero-day; its MSRC “notable CVEs” section lists just two. Here is the pair:

CVE-2026-108398 (.NET Framework, CVSS 8.8). An untrusted-search-path flaw found by Google Project Zero’s James Forshaw. An authenticated local attacker can place a crafted .NET assembly and register it for loading by a protected process, bypassing Windows Defender Application Control and running code inside that process — no user interaction. No confirmed exploitation yet, and Microsoft rates exploitation “less likely,” but there is no workaround: the patch is the mitigation. If you develop or deploy .NET Framework apps on machines that rely on WDAC, this is on your list.

CVE-2026-92707 (MessagePack-CSharp, CVSS 5.3). Improperly controlled sequential memory allocation leading to denial of service: a remote, unauthenticated attacker can exhaust memory when an application deserializes crafted untrusted data. Fixed in 2.5.303 and 3.1.9 — the third-party advisory went out September 17. If you ship MessagePack-CSharp, update the package.

How to check you are actually patched

On a Windows dev machine or server, the October cumulative update is KB5127648 for Windows 11 26H2/25H2/24H2 (builds 26300.9711, 26200.9711, and 26100.9711 respectively), KB5127646 for 26H1 (build 28000.3231), and KB5126653 for 23H2 (build 22621.7652). The .NET side: the 2026-10 .NET Framework security update is KB5127694, plus .NET 9.0.21 (KB5130035) and .NET 8.0.32 (KB5130034).

The quick checks:

# Build number at a glance
winver

# Is the October cumulative installed?
Get-HotFix -Id KB5127648

# Older shell, same answer
wmic qfe list brief

To get it: Settings > Windows Update > Check for updates on clients. The update is cumulative — a device already caught up on earlier updates only downloads the new content. For air-gapped or lab machines, grab the offline .msu from the Microsoft Update Catalog and install it directly. Organisations: this is a WSUS or Windows Update for Business job; approve the October cumulative and let the deadline policies do their thing.

One lifecycle note while you are looking: October 13, 2026 was the last update for Windows 11 24H2 Home and Pro — it is now end of support. Enterprise and Education editions get updates until October 12, 2027. If your dev box is still on 24H2 Home/Pro, “check for updates” will quietly stop saving you.

The 60-second triage checklist

Tonight: CVE-2026-96951. It is exploited, it bypasses the MOTW warning on files you download daily, and the CISA deadline is October 16.
Then internet-facing servers: MSMQ pair, the DHCP/RD Gateway/NPS zero-click cluster, Outlook, SharePoint, Exchange — anything a stranger’s packets can reach.
Then dev machines and CI runners: .NET Framework (CVE-2026-108398), the MessagePack-CSharp package update, and the full October cumulative.
Then the rest by risk cohort — Microsoft is explicit that risk cohorts are experimental guidance, not a classification; keep weighing exploitation, severity, attack vector, and user interaction per CVE.
Verify: Get-HotFix -Id KB5127648 on the machines you care about. The update you assume is installed is the one that is not.

The bigger picture

October 2026 is what patch management looks like when vulnerability discovery is industrialised by AI: record volumes every month, a sub-1% exploitation rate, and a gap between “what Microsoft patched” and “what you must patch” that keeps widening. The winning strategy is the boring one — an explicit triage order (exploited first, network-reachable second, everything else by risk), machines that update themselves, and a habit of verifying instead of assuming. The 1,413 number is a trivia answer. The patch order is the job.

October Patch Tuesday 2026: Ignore the 1,413 CVEs, Patch These First