Microsoft’s October Patch Tuesday addressed 1,413 vulnerabilities, according to CrowdStrike’s analysis, including 75 Critical flaws and a Windows zero-day already being exploited by attackers.
Released Oct. 13, the updates address security weaknesses across Windows, Office, .NET, and other Microsoft products. The release includes three zero-days: one actively exploited vulnerability and two others that were publicly disclosed before fixes became available.
For IT administrators, the immediate priority is the Windows Shell vulnerability that was exploited. But the enormous release also creates a broader challenge: identifying the most dangerous flaws while managing updates across enterprise environments.
Microsoft patches exploited Windows zero-day and critical Outlook flaws
CrowdStrike’s October Patch Tuesday analysis identifies elevation of privilege, remote code execution, and information disclosure as the most common vulnerability categories in Microsoft’s latest release.
Other security researchers reported slightly different figures. BleepingComputer counted 1,411 vulnerabilities, including 70 Critical flaws. The differences reflect variations in which vulnerabilities and updates researchers include in their Patch Tuesday totals.
The vulnerabilities span several categories:
- 677 elevation-of-privilege vulnerabilities, which could allow attackers to obtain additional permissions on affected systems.
- 317 remote code execution vulnerabilities that could allow malicious code to run under certain conditions.
- 254 information-disclosure vulnerabilities that could expose sensitive information.
The most urgent issue is CVE-2026-96951, an actively exploited Windows Shell security-feature-bypass vulnerability with a CVSS score of 8.8.
The flaw allows attackers to bypass Mark of the Web, a Windows security mechanism that identifies files originating from potentially untrusted sources.
Successful exploitation requires an attacker to persuade a user to open specially crafted malicious content or interact with an attacker-controlled resource. Bypassing Mark of the Web can prevent Windows and supported applications from applying protections such as SmartScreen warnings and Office Protected View.
Microsoft confirmed exploitation but has not publicly disclosed detailed information about the attacks or the organizations affected.
Two additional vulnerabilities were publicly disclosed before fixes became available:
- CVE-2026-108398 affects the .NET Framework and could allow an authenticated attacker to bypass Windows Defender Application Control restrictions. Successful exploitation could enable unauthorized code to run within a protected process.
- CVE-2026-92707 affects MessagePack-CSharp and could allow an attacker to trigger a denial-of-service condition.
Neither vulnerability was identified as actively exploited in Microsoft’s initial release information.
Outlook and enterprise infrastructure face additional risks
Beyond the exploited Windows Shell vulnerability, Microsoft’s October release addresses several serious weaknesses affecting enterprise applications and infrastructure.
CrowdStrike identified five Critical Outlook remote code execution vulnerabilities, each carrying a CVSS score of 9.8. Two Outlook vulnerabilities, CVE-2026-70291 and CVE-2026-88156, are particularly concerning because they can be exploited through Outlook’s Reading Pane.
According to CrowdStrike, these two vulnerabilities can be exploited without authentication or user interaction. A specially crafted email could trigger remote code execution when Outlook processes it in the Reading Pane. The outlet identified 23 vulnerabilities involving preview-triggered exposure across Office applications.
Separately, the firm highlighted 20 Critical remote code execution vulnerabilities affecting Excel, PowerPoint, Visio, and Word. Six explicitly identify the Preview Pane as an attack vector, all affecting Word or PowerPoint. The other 14 affect Excel and Visio and do not list the Preview Pane as an attack vector.
That distinction matters for organizations relying on employee awareness training to prevent malicious document attacks. Although user caution remains important, certain vulnerabilities can expose systems even when employees avoid opening suspicious attachments.
Critical remote code execution vulnerabilities also affect Microsoft’s QUIC implementation and PostScript printer driver.
The QUIC flaws could allow unauthenticated attackers to execute code against vulnerable services using the affected networking component. Printer driver vulnerabilities may expose systems to malicious print content, depending on configuration and exploitation requirements.
Actual exposure depends on software versions, configurations, and network accessibility.
The October update follows another unusually large Patch Tuesday in September, when Microsoft addressed more than 970 vulnerabilities, including two actively exploited zero-days.
As TechRepublic previously reported in its September Patch Tuesday coverage, that release also placed considerable pressure on administrators responsible for evaluating and deploying security updates across large Windows environments.
What the October updates mean for Windows users and IT teams
The immediate concern for organizations is identifying which systems are affected by the exploited Windows Shell vulnerability and ensuring that the appropriate security updates are installed.
However, October’s Patch Tuesday also coincides with an important Windows servicing deadline:
- Microsoft confirmed that Windows 11 version 24H2 Home and Pro reached the end of servicing on Oct. 13, 2026, meaning those editions will no longer receive regular monthly security updates.
- Windows 11 version 24H2 Enterprise and Education editions remain supported until October 12, 2027.
- Windows 10 Enterprise LTSB 2016 also reached its end-of-support date on October 13, 2026.
Microsoft offers paid Extended Security Updates for eligible Windows 10 Enterprise LTSB 2016 devices, allowing organizations to continue receiving critical and important security fixes while completing their migrations.
Organizations must purchase and activate ESU licenses and ensure eligible devices meet Microsoft’s prerequisite servicing requirements.
For Windows 10 Enterprise LTSB 2016, Microsoft specifies the September 2026 servicing stack update KB5122874 and security update KB5123099, or later applicable updates, as prerequisites.
As TechRepublic previously explained in its coverage of the Windows 11 24H2 support deadline, organizations managing mixed Windows environments need to distinguish between editions rather than assuming every device running the same Windows version has identical support coverage.
Microsoft also introduced illustrative risk cohorts to help organizations group vulnerabilities by shared exposure and deployment considerations.
In its Oct. 13 explanation of risk cohorts, Microsoft emphasized that the approach is experimental, does not establish a new official vulnerability classification system, and does not change its existing patching guidance.
The provisional groupings are intended to help security teams identify vulnerabilities that require similar assessments of deployment, exposure, and system configuration.
However, they should not replace individual vulnerability assessments. Administrators must still consider exploitation activity, severity, attack vectors, and the importance of affected systems.
Another consideration is update reliability. On Oct. 14, Microsoft added a known issue to its September 22 update documentation, warning that non-administrator users may experience Remote Desktop connection failures on devices with Administrator protection enabled.
The problem affects systems running KB5124010 or later applicable updates and can produce error 0xC000000D, indicating that an invalid token was passed to a function.
According to Microsoft’s Windows update documentation, administrators can temporarily mitigate the issue by disabling Administrator protection on affected Remote Desktop host devices through Intune or Group Policy. Because this reduces a security safeguard, organizations should assess the risk and limit the workaround to affected systems.
This is a separate compatibility issue, not a vulnerability fixed by October’s Patch Tuesday.
In an earlier example of update-related disruption, TechRepublic examined Microsoft’s emergency fixes for Remote Desktop and Hyper-V problems. That incident was separate from the newer Administrator protection issue.
Must-read security coverage
- UK Police Convicts Pair in £5.5 Billion Bitcoin Launder Case
- Blackpoint Cyber vs. Arctic Wolf: Which MDR Solution is Right for You?
- How GitHub Is Securing the Software Supply Chain
- 8 Best Enterprise Password Managers
What IT administrators should do now
For IT departments, October’s record-breaking release makes prioritization particularly important. Rather than treating every vulnerability as equally urgent, administrators should evaluate confirmed exploitation, potential attack paths, affected assets, and operational consequences.
Security teams should focus on five immediate actions:
- Prioritize the exploited Windows Shell vulnerability. Identify affected Windows endpoints and deploy applicable updates promptly. Review endpoint security alerts for suspicious activity involving downloaded files and Windows Shell processes. Reinforce phishing defenses because exploitation requires interaction with malicious content.
- Review Outlook and enterprise infrastructure exposure. Determine whether deployed Outlook versions, QUIC-related components, and PostScript printer drivers are affected by October’s critical vulnerabilities. Give particular attention to vulnerabilities in the Outlook Reading Pane, Office preview-related flaws, and network-accessible services that could be exploited without authentication.
- Verify Windows support status. Identify devices running Windows 11 24H2 Home or Pro and Windows 10 Enterprise LTSB 2016. Develop upgrade plans for unsupported editions, assess eligibility for Extended Security Updates where applicable, and verify that devices meet Microsoft’s ESU activation prerequisites.
- Test updates and monitor compatibility. Validate security updates on representative devices and critical applications before broad deployment where operationally necessary. Pay particular attention to Remote Desktop environments using Administrator protection and monitor Microsoft’s known-issue guidance.
- Confirm successful remediation. Use endpoint management and vulnerability scanning tools to verify that updates have installed successfully and that affected systems are no longer exposed.
Administrators should consult Microsoft’s October Security Update Guide for affected product versions, individual vulnerability advisories, and applicable fixes before deployment.
For Windows administrators, October’s Patch Tuesday demands more than installing a record number of fixes. The immediate priority is closing the exploited Windows Shell vulnerability, followed by assessing critical Outlook and infrastructure flaws, verifying device support status, and confirming that updates have been successfully deployed.
Related reading: For IT teams planning Windows upgrades, TechRepublic explains Windows 11 26H2 upgrade requirements and what administrators should check before deployment.