More than 1,400 fixes in one day. Microsoft’s October 13 release is its biggest Patch Tuesday yet, with BleepingComputer counting 1,411 flaws, including an exploited Windows Shell zero-day and two bugs already made public. Install the update now, with KB5127648 covering several Windows 11 releases and KB5126657 covering eligible Windows 10 devices.
You see, the exploited flaw still needs you to open a malicious file. That makes this update relevant to your inbox and downloads, even if you never touch a server. Here are the key facts before you start.
| Item | Detail |
|---|---|
| Release date | October 13, 2026 |
| Total flaws | 1,411 according to BleepingComputer, 1,413 in Microsoft’s release note |
| Critical flaws | BleepingComputer counts 70, other trackers report 75 to 85 |
| Zero-days | Three, with one exploited and two publicly disclosed |
| Windows 11 updates | KB5127648, KB5126653 and KB5127646 |
| Windows 10 update | KB5126657 for ESU and eligible LTSC devices |
| Main known issue | Problems with some USB audio devices |
What the October 2026 Patch Tuesday Fixed
The update reaches well beyond your Windows desktop. Microsoft’s product totals include 1,102 Windows flaws, 134 in Office, 36 in SharePoint Server, 22 in SQL Server, 61 in Developer Tools and seven in Exchange Server. To see what those fixes address, start with the reported vulnerability categories.
| Vulnerability type | Count |
|---|---|
| Elevation of privilege | 677 |
| Remote code execution | 317 |
| Information disclosure | 254 |
| Denial of service | 73 |
| Security feature bypass | 40 |
| Spoofing | 28 |
These category figures are approximate. BleepingComputer’s Patch Tuesday count also leaves out 348 fixes released earlier in October for Azure services, Exchange Server and Partner Center.
Why do the totals differ? The supplied reports do not settle that discrepancy. Microsoft lists 1,413 CVEs, while its summary row reads 1,414. SANS counts 1,417. For your update decision, more than 1,400 is the safest description.
The Three Zero-Days at a Glance
The three zero-days do not carry the same attack status. One has already been used in attacks, while the other two were publicly known before the patches arrived. Start with this comparison, then check what each means for your PC or application.
| CVE | Product | Type | CVSS | Status exploited or public | Who found it |
|---|---|---|---|---|---|
| CVE-2026-96951 | Windows Shell | Security feature bypass | 8.8 | Exploited | Not named |
| CVE-2026-108398 | .NET Framework | WDAC bypass | 8.8 | Public | James Forshaw, Google Project Zero |
| CVE-2026-92707 | MessagePack-CSharp | Denial of service | 5.3 | Public | Not named |
CVE-2026-96951 Windows Shell Bypass
This flaw bypasses Mark of the Web protections and affects Windows 10, Windows 11 and some Windows Server releases. You must open an attacker’s file, delivered through email, instant messaging or a web download, for the reported attack to work.
Microsoft confirms exploitation, but has not published details of the attacks. Your practical next step is to patch and avoid files from unknown senders.
CVE-2026-108398 .NET Framework WDAC Bypass
An attacker with authenticated local access can place a specially prepared .NET assembly to bypass Windows Defender Application Control. Unlike the Shell flaw, this bug does not require you to interact with a file.
James Forshaw of Google Project Zero reported it. Microsoft had seen no exploitation when the update was released.
CVE-2026-92707 MessagePack-CSharp Denial of Service
This Moderate-rated bug concerns a NuGet dependency used in software development rather than a built-in Windows component. It allows denial of service over a network.
If you develop software using MessagePack-CSharp, treat it as a dependency issue. Its CVSS score is 5.3, below the two 8.8-rated bypass bugs.
Other Critical Bugs Worth Your Attention
The zero-days are only part of your patching workload. Outlook has five Critical remote code execution flaws rated 9.8, and 23 Office vulnerabilities can be triggered through the Preview Pane without opening a file. If you use these applications or manage servers, check the following fixes too.
| Component | CVE | CVSS | Why it matters |
|---|---|---|---|
| Outlook | CVE-2026-70242, CVE-2026-70291 | 9.8 | Examples among five Critical Outlook code execution flaws |
| PowerPoint | CVE-2026-88178 | 9.8 | Office Online can be attacked without authentication |
| QUIC | CVE-2026-100219, CVE-2026-105016 | 9.8 | Network code execution without authentication |
| DHCP Server | CVE-2026-96934 | 9.8 | Critical network code execution |
| MSMQ | CVE-2026-100202 | 9.8 | Unauthenticated network code execution |
| PostScript Printer Driver | CVE-2026-70147, CVE-2026-70153 | 9.8 | Unauthenticated network code execution |
| Windows text processing | CVE-2026-97814 | 9.8 | Network code execution without authentication |
| Raw Image Extension | CVE-2026-21413 | 9.8 | Viewing a folder containing a malicious file can trigger it, update through Microsoft Store |
| Hyper-V | CVE-2026-102214, CVE-2026-105733 | 8.8 | Code execution from a guest to its host |
| Active Directory Domain Services | CVE-2026-70229 | 8.1 | Talos considers exploitation more likely |
| Exchange Server | CVE-2026-70571 | 8.1 | Talos considers exploitation more likely, a specially prepared email can trigger it during content conversion |
KB Numbers and Builds for Each Windows Version
Your KB number depends on the Windows release you run. KB5127648 serves three Windows 11 releases, while Windows 10’s KB5126657 is restricted to ESU-enrolled devices and eligible Enterprise LTSC installations. Use this table to match your version with the reported package and build.
| Windows version | KB number | OS build |
|---|---|---|
| Windows 11 26H2 | KB5127648 | 26300.9711 |
| Windows 11 25H2 | KB5127648 | 26200.9711 |
| Windows 11 24H2 | KB5127648 | 26100.9711 |
| Windows 11 23H2 | KB5126653 | 22621.7652 reported, sources differ |
| Windows 11 26H1 | KB5127646 | 28000.3231 |
| Windows 10 22H2 and 21H2 | KB5126657 | 19045.7807 |
| Windows 10 Enterprise LTSC 2021 | KB5126657 | 19044.7807 |
| Windows Server 2025 | KB5126646 | Not specified in the research |
| Windows Server 2022 | KB5126655 | Not specified in the research |
| Windows Server 2019 | KB5126651 | Not specified in the research |
| Windows Server 2016 | KB5126868 | Not specified in the research |
| Servicing stack update | KB5127647 | Not specified in the research |
For Windows 11 23H2, HTMD reports 22621.7652, while Pureinfotech lists both 22621.7652 and 22631.7652. That remains unresolved in the supplied research. October is also the final update for Windows 11 24H2 Home and Pro, so plan your move to a newer release.
How to Install the October Update on Your PC
You can get the cumulative Windows update through Windows Update or install standalone packages manually. Remember the separate Raw Image Extension fix too, since Windows Update does not deliver it. Work through these steps.
- Create a restore point or backup before you install. Pureinfotech recommends this preparation.
- Open Windows Update on your PC and select Check for updates. Download and install the October package offered for your Windows version.
- Complete the requested restarts. Several forum users reported three or four restarts, so allow for more than one reboot.
- If you need a manual installation, use the Microsoft Update Catalog. Follow the specified installation order for the standalone MSU packages and the instructions for x64 or Arm64.
- Check Microsoft Store for the Raw Image Extension update. If you manage devices where the Store is blocked, account for that separate delivery route.
Patching Advice for IT Admins
More than 1,400 fixes can leave you wondering where to start. You still need to test before deployment, but the exploited bugs deserve priority over the headline total. Build your rollout around the following tasks.
- Put known attacks first. Prioritise CVE-2026-96951. Fortra’s Tyler Reguly also recommends addressing the 26 Microsoft flaws added to CISA’s Known Exploited Vulnerabilities catalogue this year.
- Check exposed applications and services. Prioritise Office and Outlook Preview Pane flaws, then review DHCP, Exchange, Active Directory Domain Services and Hyper-V.
- Use your deployment tools. Intune quality update policies can expedite installation. In SCCM, sync WSUS and search for “10-2026 Cumulative Update for Windows 11”.
- Include installation media. Copy boot.stl from Windows\Boot\EFI when updating your media. Omitting it can produce error 0xc0430001.
- Account for Microsoft Store. Raw Image Extension receives its fix there. If your organisation blocks the Store, your Windows rollout can leave that separate update outstanding.
- Review server protection. Hotpatching is generally available for Windows Server Azure Edition VMs. If you run Cisco Secure Firewall, update its SRU for Talos’s new Snort rules.
- Use risk cohorts carefully. Microsoft grouped related CVEs into 15 experimental cohorts, including storage, Office and Windows graphics. A larger group does not mean greater danger.
- Track other vendors. October also brought the exploited Atlassian CVE-2026-21589 flaw and Citrix NetScaler zero-day, alongside updates from other vendors.
Known Issues to Watch
Installing the security fixes does not resolve every existing Windows problem. USB audio remains the main reported issue, and installation media needs separate attention. Keep these notes beside your rollout checklist.
- USB audio failures. Since September’s update, some USB Audio Class 1.0 devices have produced no sound, inactive volume controls or Code 10 in Device Manager. Some work in stereo but fail with multichannel audio.
- Partial audio repair. KB5129195 addressed some eight-channel and 3D audio problems. Microsoft is still working on the remaining symptoms, so October does not provide a complete fix.
- Temporary audio option. Two-channel output helped some affected users. Businesses can ask Microsoft Support for Business about a workaround.
- Boot media user report. One forum user reported Secure Boot SVN reaching 12 and needing to rebuild bootable media. Other users were unaffected, so treat this as an individual report.
- Certificate transition. For Windows Secure Boot certificate expiration, Windows Update continues delivering replacement certificates. Microsoft says devices without them can still start and receive standard updates.
Why This Month Is So Big
You are seeing larger patch batches partly because Microsoft is using AI and large language models to find more bugs, according to reporting from BleepingComputer and Krebs. October follows a September release containing nearly 1,000 fixes. That puts this month’s volume in context.
The 2026 count is already above 4,000, and two months remain. Tenable’s Satnam Narang says it exceeds the 2020 record of 1,261 CVEs.
That leaves your IT team with more updates to assess and test. The lesson is practical. Use confirmed exploitation and affected systems to set priorities, as the experts cited in the research recommend.
Windows 10 and Windows 11 Support Deadlines
Your October patch is only one part of staying supported. Some editions are receiving their final updates, while Windows 10 consumer ESU has been extended again. Check your edition against these deadlines before deciding what comes next.
| Version | Status | What to do |
|---|---|---|
| Windows 11 24H2 Home and Pro | October is the final update | Move to a newer Windows 11 release |
| Windows 11 23H2 Enterprise, Education and IoT Enterprise | Security support ends in November 2026 | Plan your version upgrade |
| Windows 10 Enterprise LTSB 2016 | October is the final update | Plan a move from this release |
| Windows 10 consumer ESU | Extended through October 12, 2027 | Existing enrolment continues automatically |
| Windows 10 business ESU | Up to three years, costing $427 per device in total | Use business ESU for eligible business devices |
Consumer ESU offers free enrolment through Microsoft account backup synchronisation or 1,000 Microsoft Rewards points. You can also pay $30. One licence covers up to 10 devices on your Microsoft account, but consumer coverage excludes domain-joined, Entra-joined and MDM-managed PCs.
Our Take
If you use Windows at home, install the October update today and complete the restarts. If you manage business systems, start with the exploited Shell flaw and known exploited vulnerabilities, then work through your affected applications and servers. Your next priority depends on the systems you run.
Keep the separate Microsoft Store fix on your list, and check your Windows support deadline too. The next Patch Tuesday falls on November 10, 2026, under the second-Tuesday schedule. You can also read our Samsung October security update guide.
FAQs
You can expect Microsoft’s regular monthly patches on the second Tuesday, at 10 a.m. Pacific Time. The following day is informally known as Exploit Wednesday.
Yes, consumer ESU now gives you coverage through October 12, 2027. You can enrol through the free backup or Rewards options, or pay $30 for coverage on up to 10 devices tied to one Microsoft account.
You may receive Emoji 17.0, Copilot key reassignment and Camera Roll Backup to OneDrive, with features arriving gradually. Other changes include removal of PC-to-PC Migration and a new Manitoba time zone. October also brings the final update for Windows 11 24H2 Home and Pro.
KB5126657 is available to ESU-enrolled PCs and eligible Enterprise LTSC devices, so you should check whether your installation qualifies. Staying on Windows 10 alone does not establish eligibility for that update.
Yes, it affects Windows 10 and Windows 11, so your home PC can be affected. The attack requires you to open a malicious file from email, instant messaging or a download. Install the patch and avoid files from unknown sources.
Your experience matches forum reports of three or four restarts during installation. Those reports included successful installations, so several reboots alone do not establish that the update failed.
No, the issue remains only partly repaired. KB5129195 addressed some eight-channel and 3D audio faults, while Microsoft continues working on other symptoms. Two-channel output has helped some users.
