Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days
- October 13, 2026
- 03:56 PM
- 0
Today is Microsoft's October 2026 Patch Tuesday, with security updates addressing a record-breaking 1,411 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities.
This Patch Tuesday addresses 70 "Critical" vulnerabilities, 57 of which are remote code execution, 11 are elevation of privileges, and 2 are spoofing.
The approximate number of bugs in each vulnerability category is listed below:
- 677 Elevation of Privilege Vulnerabilities
- 40 Security Feature Bypass Vulnerabilities
- 317 Remote Code Execution Vulnerabilities
- 254 Information Disclosure Vulnerabilities
- 73 Denial of Service Vulnerabilities
- 28 Spoofing Vulnerabilities
When BleepingComputer reports on Patch Tuesday security updates, we only count vulnerabilities released by Microsoft on Patch Tuesday itself.
Therefore, today's total excludes 348 flaws fixed earlier this month, including vulnerabilities in Azure API Center, Azure App Service, Azure Event Grid, Azure SRE Agent, Mariner, Microsoft Bookings, Microsoft Dataverse, Microsoft Exchange Server, and Microsoft Partner Center.
This is a record-breaking Microsoft Patch Tuesday as Microsoft continues to use artificial intelligence platforms to find and remediate security vulnerabilities in its products.
Microsoft announced today that Windows 11, version 24H2 Home and Pro, and Windows 10 Enterprise LTSB 2016 have reached end of support.
"Today, October 13, 2026, Windows 11, version 24H2 Home and Pro, and Windows 10 Enterprise LTSB 2016 have reached end of updates. The October 2026 monthly security update is the last update available for these editions," Microsoft said.
Earlier this month, Microsoft also said organizations running Windows 11 23H2 Enterprise, Education, and IoT Enterprise editions should upgrade to newer versions as they will no longer receive security updates starting next month.
Microsoft patches 2 zero-days
This month's Patch Tuesday fixes one actively exploited and two publicly disclosed zero-day vulnerabilities.
Microsoft classifies a zero-day flaw as publicly disclosed or actively exploited when no official fix is available.
The actively exploited zero-day vulnerabilities addressed during this October 2026 Patch Tuesday are:
CVE-2026-96951 - Windows Shell Security Feature Bypass Vulnerability
Microsoft patched an actively exploited zero-day security bypass flaw that allowed attackers to bypass the Mark of the Web security feature.
"Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network," warns Microsoft.
No details have been shared on how attackers exploited the flaw or who disclosed it.
The two zero-days that were publicly disclosed are:
CVE-2026-108398 - .NET Framework Security Feature Bypass Vulnerability
Microsoft has fixed a security feature bypass in the .NET Framework that can be exploited to run unauthorized applications.
"Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally," explains Microsoft.
Microsoft says this flaw could allow attackers to bypass Windows Defender Application Control (WDAC) enforcement and run unauthorized applications.
"An authenticated attacker could place a specially crafted .NET assembly on an affected system and register it for loading by a protected process." Microsoft says.
"Successful exploitation could bypass Windows Defender Application Control restrictions and allow the attacker to execute code within the protected process. User interaction is not required."
James Forshaw of Google Project Zero discovered the flaw.
CVE-2026-92707 - MessagePack-CSharp Denial of Service Vulnerability
Microsoft fixed a denial-of-service flaw in MessagePack-CSharp.
"Improperly controlled sequential memory allocation in .NET allows an unauthorized attacker to deny service over a network," explains Microsoft.
Microsoft has not shared who disclosed the vulnerability.
Recent updates from other companies
Other vendors who released updates or advisories in October 2026 include:
- Adobe released security updates for numerous products, including Commerce, Substance 3D Samples, ColdFusion, Photoshop, Dimension, and Framework.
- Atlassian released security updates for a critical vulnerability (CVE-2026-21589) in multiple self-hosted Data Center products, including Confluence, Jira, and Bitbucket. Attackers soon exploited the flaw after a PoC was released.
- Cisco released security updates for numerous products, including critical vulnerabilities in its NX-OS data center network operating system that can let attackers run arbitrary code with root privileges on Nexus switches.
- Citrix released security updates for NetScaler ADC and NetScaler Gateway flaws, with CVE-2026-88779 exploited in zero-day attacks before it was patched.
- Dell released security updates for critical vulnerabilities in the System Update (DSU) command-line interface (CLI) deployment tool and Container Storage Modules (CSM).
- Docker patched a critical flaw in DockerHub that lets attackers impersonate users and push images from others' repositories.
- Fortinet released security updates for numerous products, including a critical FortiMail vulnerability (CVE-2026-104286) that attackers exploited in zero-day attacks.
- GitLab released security updates for critical flaws in AI Gateway and CI/CD Regular Expression Compiler.
- Ivanti released security updates for an actively exploited zero-day vulnerability in the Ivanti Connect Secure (ICS) remote access gateway.
- Kiteworks released security updates for 126 vulnerabilities, including a max-severity flaw affecting its Email Protection Gateway (EPG) security solution.
- Progress Software released security updates for critical and high security vulnerabilities in MarkLogic Server.
- SAP released the October security updates, addressing 20 security flaws, including a maximum-severity OAuth2 SSRF vulnerability in Cloud SDK for Python.
- SonicWall released security updates for a critical SMA1000 server-side request forgery (SSRF) flaw, which attackers exploited within two days.
The October 2026 Patch Tuesday Security Updates
Below is the complete list of resolved vulnerabilities in the October 2026 updates. Note, this report does include the flaws fixed earlier this month.
To access the full description of each vulnerability and the systems it affects, you can view the full report here.
Tag CVE ID CVE Title Severity .NET CVE-2026-70161 .NET Elevation of Privilege Vulnerability Important .NET CVE-2026-70174 .NET Remote Code Execution Vulnerability Important .NET CVE-2026-70162 .NET Denial of Service Vulnerability Important .NET CVE-2026-92707 MessagePack-CSharp Denial of Service Vulnerability Moderate .NET CVE-2026-87697 .NET Remote Code Execution Vulnerability Important .NET CVE-2026-96959 .NET Denial of Service Vulnerability Important .NET CVE-2026-96960 .NET Denial of Service Vulnerability Important .NET CVE-2026-96957 .NET Security Feature Bypass Vulnerability Important .NET CVE-2026-96958 .NET Denial of Service Vulnerability Important .NET CVE-2026-96234 .NET Information Disclosure Vulnerability Important .NET CVE-2026-96238 .NET Security Feature Bypass Vulnerability Important .NET CVE-2026-96235 .NET Remote Code Execution Vulnerability Important .NET CVE-2026-96237 .NET Remote Code Execution Vulnerability Important .NET CVE-2026-96231 .NET Elevation of Privilege Vulnerability Important .NET CVE-2026-96224 .NET Remote Code Execution Vulnerability Important .NET CVE-2026-70165 .NET Elevation of Privilege Vulnerability Important .NET CVE-2026-96229 .NET Information Disclosure Vulnerability Important .NET CVE-2026-96225 .NET Elevation of Privilege Vulnerability Important .NET CVE-2026-70197 .NET Remote Code Execution Vulnerability Important .NET CVE-2026-70190 .NET Elevation of Privilege Vulnerability Important .NET CVE-2026-58280 .NET Denial of Service Vulnerability Important .NET CVE-2026-69651 .NET Denial of Service Vulnerability Important .NET CVE-2026-84008 .NET Denial of Service Vulnerability Important .NET CVE-2026-66822 .NET Information Disclosure Vulnerability Important .NET CVE-2026-83520 .NET Remote Code Execution Vulnerability Important .NET CVE-2026-96232 .NET Information Disclosure Vulnerability Important .NET and Visual Studio CVE-2026-102869 .NET and Visual Studio Elevation of Privilege Vulnerability Important .NET Framework CVE-2026-108398 .NET Framework Security Feature Bypass Vulnerability Important .NET Framework CVE-2026-70194 .NET Framework Security Feature Bypass Vulnerability Important .NET Framework CVE-2026-70007 .NET Framework Remote Code Execution Vulnerability Important .NET Framework CVE-2026-70035 .NET Framework Remote Code Execution Vulnerability Important .NET Framework CVE-2026-97801 .NET Framework Tampering Vulnerability Important .NET Framework CVE-2026-85363 .NET FrameworkWas this article helpful?