Microsoft’s October 2026 Patch Tuesday fixes 1,411 flaws, per BleepingComputer’s count of what shipped today. That beats September’s record and doesn’t include another 348 fixed earlier this month across Azure, Dataverse, Bookings and Exchange Server. Seventy are rated Critical, 57 of them remote code execution.
The one to move on is CVE-2026-96951, a Windows Shell security feature bypass that Microsoft says is exploited in the wild. It’s a command injection that lets an unauthenticated attacker get around Mark of the Web over a network. In plain terms, a downloaded file can open without the SmartScreen and Protected View checks that are supposed to catch it. Microsoft hasn’t said who’s using it or how. CISA added it to the Known Exploited Vulnerabilities catalog today, flagged it for forensic triage, and set an October 16 deadline for federal agencies.
Why that matters on a SOC floor: phishing crews like MotW bypasses because they quietly strip the warning from ISO, LNK and archive lures. Until the patch is everywhere, hunt for Explorer or a shell host spawning script interpreters (mshta, wscript, powershell) right after a user opens a file from Downloads or a mounted image. Also check endpoint telemetry for internet-origin files that ran without a Zone.Identifier stream attached.
Two more were publicly disclosed before the fix. CVE-2026-108398 is a .NET Framework bypass of Windows Defender Application Control. An authenticated attacker can load a crafted assembly into a protected process and run code that WDAC should block. James Forshaw of Google Project Zero found it. CVE-2026-92707 is a denial-of-service bug in MessagePack-CSharp. Neither is marked exploited.
Priority order for most enterprise estates: the Shell zero-day first, then Critical RCEs on servers reachable from the internet. Patch WDAC-enforced hosts next. October is also the last update for Windows 11 24H2 Home and Pro and for Windows 10 Enterprise LTSB 2016, so anything still running those stops getting fixes after today.