Microsoft’s October Patch Tuesday release addresses a record-breaking 1,413 vulnerabilities, including an actively exploited Windows Shell zero-day and two other publicly disclosed flaws.
Just when you thought a previous record would stand for a while, Microsoft comes out again with the largest monthly Patch Tuesday release. Microsoft has said its growing use of AI to find and fix security vulnerabilities means users should expect more fixes in its monthly updates.
How to apply patches and check if you’re protected
These updates fix security problems and help keep your Windows PC protected. Here’s how to make sure you’re up to date:
- Click the Start button, then open Settings.
- Select Windows Update (usually at the bottom of the menu on the left).
- Click Check for updates. Windows will search for the latest security updates. If you’ve enabled Get the latest updates as soon as they’re available under More options, you may be prompted to restart immediately to complete the update.
- Otherwise, continue to the next step.
- If updates are available, they’ll start downloading automatically. When they’re ready, click Install or Restart now if prompted. Your computer may need a restart to finish the update.
- After restarting, go back to Windows Update and check again. If it says You’re up to date, you’re all set.
Technical details
As usual, we’ve selected a few vulnerabilities to highlight for readers interested in the technical details.
We’ll start with the actively exploited vulnerability tracked as CVE-2026-96951 (CVSS score 8.8 out of 10), a Windows Shell security feature bypass vulnerability.
The security feature it can bypass is the Mark of the Web (MOTW) defense, which can warn users about potentially unsafe downloaded files.
Successful exploitation requires user interaction. For example, in an email or instant message attack, the attacker could send the targeted user a specially crafted file designed to exploit the vulnerability, but the user would have to click a link or open an attachment.
Another one to keep an eye on is CVE-2026-108398 (CVSS score 8.8 out of 10), where an untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally. The bypassed feature is Windows Defender Application Control (WDAC), which could lead to the ability to run unauthorized applications on target systems. This vulnerability was publicly disclosed before the patch.
Another publicly disclosed vulnerability is CVE-2026-92707 (CVSS score 5.3 out of 10). The flaw can let an unauthenticated remote attacker exhaust memory in affected applications that process specially crafted MessagePack data. MessagePack-CSharp is a software component that helps applications pack and unpack data in a compact format, making it efficient to store or exchange information. Exposure depends on how a service uses the library to pack and unpack the information.
From reporting threats to removing them.
Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.
