Microsoft's October 2026 Patch Tuesday fixes 1,411 flaws, including three zero-days

13 October 2026 is Microsoft's October Patch Tuesday, and the company's security updates address a record-breaking 1,411 flaws. According to BleepingComputer, this month's batch includes one actively exploited zero-day and two publicly disclosed zero-days, alongside 70 flaws rated "Critical".

What's happening

BleepingComputer reports that Microsoft's October 2026 Patch Tuesday updates fix 1,411 vulnerabilities. Of those, 70 are rated "Critical": 57 are remote code execution, 11 are elevation of privilege, and 2 are spoofing issues. The outlet notes it counts only vulnerabilities released on Patch Tuesday itself, so the total excludes 348 flaws Microsoft fixed earlier in the month across services such as Azure, Exchange Server and others.

The updates address one actively exploited zero-day: a security-feature bypass that reportedly allows an attacker to bypass the Mark of the Web feature. Microsoft's description says an "improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network." BleepingComputer notes that no details have been shared about how the flaw was exploited or who disclosed it.

The two publicly disclosed zero-days are, per BleepingComputer:

A .NET Framework security-feature bypass (an "untrusted search path") that could let an attacker bypass Windows Defender Application Control (WDAC) enforcement and run unauthorized applications. Microsoft says successful exploitation could execute code within a protected process and does not require user interaction. The flaw was discovered by James Forshaw of Google Project Zero.
A denial-of-service flaw in MessagePack-CSharp, described as "improperly controlled sequential memory allocation in .NET" that can let an unauthorized attacker deny service over a network. BleepingComputer says Microsoft has not shared who reported it.

With this month's record number of fixes, Microsoft also introduced a new way for organizations to triage them: grouping related flaws into what it calls "risk cohorts." Microsoft stresses the groups do not necessarily indicate which flaws are most dangerous, and that the approach is still experimental and is meant to complement, not replace, existing patching recommendations.

The October release is also notable for support changes. BleepingComputer reports that Windows 11 version 24H2 (Home and Pro) and Windows 10 Enterprise LTSB 2016 reached the end of support on 13 October 2026, making this their last monthly security update. It adds that Windows 11 23H2 Enterprise, Education and IoT Enterprise editions will stop receiving security updates next month.

Who's affected

Anyone running supported Microsoft products, including Windows, .NET, Office and server products — the fixes span a broad set of components, and the WDAC/Mark of the Web protections are relevant to most Windows users.
Users on Windows 11 24H2 (Home and Pro) and Windows 10 Enterprise LTSB 2016: this is the final update available for those editions, so staying secure means moving to a supported version.
Organizations on Windows 11 23H2 Enterprise, Education or IoT Enterprise: BleepingComputer reports these will no longer receive security updates starting next month.

What to do

Install the October 2026 updates. Use Windows Update or your usual patch process, and prioritize internet-facing and business-critical systems.
Pay attention to the zero-days. One is already being exploited and two are publicly disclosed, so these warrant earlier patching where possible.
Plan upgrades for editions leaving support. Windows 11 24H2 (Home and Pro) and Windows 10 Enterprise LTSB 2016 have reached end of updates; Windows 11 23H2 Enterprise/Education/IoT Enterprise follow next month.
Use risk cohorts as an aid, not a substitute. Microsoft says the grouping is experimental and does not replace existing prioritization.

Sources

BleepingComputer — reports the 1,411 flaws and severity split, details the exploited and disclosed zero-days, the new "risk cohorts" feature, and the October support cut-offs.
Neowin — its Patch Tuesday coverage notes Microsoft's Office LTSC 2021 security updates released the same day.