Microsoft released its largest security update on October 13, 2026, addressing 1,411 vulnerabilities across 176 updates spanning Windows, Office, Exchange, SQL Server, Azure, and other services. The release includes one actively exploited Windows Shell zero-day (CVE-2026-96951) enabling security feature bypass, two publicly disclosed zero-days (.NET Framework CVE-2026-108398 and MessagePack-CSharp CVE-2026-92707), and 70 critical vulnerabilities. Organizations should prioritize patching the Windows Shell flaw first.
- Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-d(opens in a new tab)
- Microsoft October 2026 Patch Tuesday: Largest Release Ever Ships(opens in a new tab)
- October 2026 Patch Tuesday: 1,400 Fixes, Exploited Windows Shell(opens in a new tab)
- Zero Day Initiative — The October 2026 Security Update Review(opens in a new tab)
- Zero-Days Lurk in Microsoft's Overgrown October Patch Tuesday(opens in a new tab)
- Kwetsbaarheden verholpen in Microsoft Azure | Threat Radar(opens in a new tab)
// Get alerts for Microsoft Azure