October Patch Tuesday: 1,411 fixes and one exploited Windows flaw

Microsoft's October 13 security release is the largest it has shipped. BleepingComputer counts 1,411 flaws, 70 of them rated Critical; Tenable's count is 1,407 across 301 products and components. It is the second month in a row that the record has been broken.

One flaw is already being used in attacks. CVE-2026-96951 lets a crafted file get past Mark of the Web, the tag Windows puts on downloads and email attachments so that Office and SmartScreen treat them with suspicion. CISA added it to its Known Exploited Vulnerabilities catalog the same day. On the same afternoon Ivanti disclosed an exploited zero-day in Connect Secure, its VPN appliance, which matters more for any company that runs one.

With more than 1,400 fixes in one month, nobody tests each patch by hand. The useful question is which few to push first, and which systems cannot wait for the normal cycle.

Patch first

The exploited Windows flaw

CVE-2026-96951 sits in Windows Shell, the part of Windows that handles files and folders. Microsoft has not said how it is being used. Tenable says attacks rely on a person opening a malicious file sent by email or chat. Once the Mark of the Web tag is skipped, the warnings and Protected View that normally stop a downloaded file from running code do not appear.

By Tenable's count, attackers have now used three Windows Shell flaws in 2026. The fix covers Windows 10 and 11 and Windows Server from 2012 R2 to 2025. Microsoft lists no workaround, so the update is the only fix.

The second zero-day, CVE-2026-108398, was public before the patch but is not known to be exploited. It can be used to slip past Windows Defender Application Control (WDAC), the allow-listing feature many companies use to stop unapproved programs. James Forshaw of Google Project Zero reported it, according to BleepingComputer. If WDAC is part of your control set, this one belongs in the first wave.

BleepingComputer lists a third publicly disclosed flaw, a denial-of-service bug in the MessagePack-CSharp library (CVE-2026-92707). CSO Online names a SharePoint account-takeover flaw (CVE-2026-102866) instead. Microsoft's own notes are the place to settle which one you need to track.

Exchange and Active Directory

On-premises Exchange gets several fixes this month. Tenable picks out two: CVE-2026-70571, a Critical remote code execution flaw set off by a malicious email that abuses Exchange's internal content conversion, and CVE-2026-70279, a spoofing flaw rated 9.3 that is triggered through a link. Microsoft rates both as more likely to be exploited.

That is a short window for Exchange 2016 and 2019. As we reported on Monday, their paid extended updates end on October 31. Servers not on Exchange Server Subscription Edition by then stop getting fixes like these.

The Active Directory Domain Services flaw, CVE-2026-70229, needs only a crafted network packet to run code. Domain controllers should be in your first ring of servers this week, not the last.

Dustin Childs of TrendAI's Zero Day Initiative told CSO Online that 55 of the fixes are wormable, mostly in three Windows Server roles: DHCP, Network Policy Server and Remote Desktop Gateway. Those roles often sit at the network edge, so check which of your servers run them.

Ivanti Connect Secure: patch, then hunt

Ivanti's advisory says CVE-2026-104935 lets a remote attacker with no account run commands on Connect Secure. Fixed builds are 22.8R2.5, 25.1.1.2 and 25.1.3.0 or later. Versions 22.7 and older are not affected.

Volexity, which found the attacks, says exploitation started on October 3 and that the attacker chained a second flaw to get root. That second flaw has no patch yet; Ivanti says a fix is coming in a later release. The attacker pulled stored domain credentials used for LDAP, queried Active Directory for LAPS admin passwords and BitLocker recovery keys, and wiped logs.

Ivanti's Integrity Checker Tool did not catch it. Volexity says the chain changed code only in memory, so a clean check does not prove a device is clean. Volexity has published indicators on GitHub.

Other October fixes under attack

BleepingComputer's round-up lists exploited flaws in several products IT teams run at the edge:

Atlassian says its flaw can only read files whose exact name and path the attacker already knows. That still includes configuration files with secrets in them.

What stopped getting patches

This was also the final update for Windows Server 2012 and 2012 R2, Office 2021 and Office LTSC 2021, and Windows 11 24H2 Home and Pro. Windows 11 23H2 Enterprise and Education get their last update in November. Our end-of-support list has the full set.