Microsoft shipped its October 2026 Patch Tuesday update on October 13. BleepingComputer counts 1,411 fixed flaws, a record. Other outlets report slightly different totals, between roughly 1,409 and 1,413, because they count differently.
One bug is exploited in the wild. CVE-2026-96951 is a Windows Shell security feature bypass that lets attackers get around Mark of the Web protections. Microsoft has not published details of the attacks or credited the researchers who found it.
Two flaws were publicly disclosed before the patch. One is CVE-2026-108398, a .NET Framework bug that lets an authenticated attacker bypass Windows Defender Application Control. No exploitation of it has been reported. One outlet claimed three exploited zero-days including a kernel flaw. Other sources do not corroborate that, so treat it as unconfirmed.
Why it matters. Mark of the Web is the flag that triggers SmartScreen and Office protected-view prompts on downloaded files. Bypassing it removes a warning users and controls rely on, which makes the bug a good fit for phishing chains that deliver archives or shortcut files.
The release also ends support for several Windows editions, including Windows 11 version 24H2 Home and Pro, according to Ivanti's Patch Tuesday write-up.
Recommended actions. Patch CVE-2026-96951 first, as Ivanti advises. Prioritise endpoints that open email attachments and downloads. Check that WDAC policies are tested against the .NET fix before broad rollout. Plan upgrades for hosts on editions that just left support. Hunt for downloaded files that execute without the usual Mark of the Web prompts.
