Lessons from Microsoft’s October 2026 Patch Tuesday

September's Patch Tuesday record lasted exactly one month. At this rate, the phrase “record-breaking Patch Tuesday” is on track to becoming redundant. Microsoft's October 2026 Patch Tuesday addresses 1,413 vulnerabilities, nearly 440 more than September's 974, and the volume conversation has started to repeat itself.

This isn’t a one-month spike. Patch Tuesday volume has been climbing over the past several months, and the last five releases show how steep that climb has become:

Even with August’s dip, the trajectory across the back half of the year is unmistakable. October’s count is roughly seven times June’s, and the past two months have each set a new all-time record. A process sized for 200 CVEs a month is now absorbing seven times that volume, with no sign the curve is flattening.

What changed this month is where the risk sits. The actively exploited zero-day and one of the publicly disclosed flaws both target controls you rely on to stop untrusted files and unapproved code, and the release doubles as the final security update for several Windows editions.

Here's what October adds to last month's lessons, and here's what to change before November's release arrives.

By the numbers  

The actively exploited flaw is CVE-2026-96951, a Windows Shell security feature bypass (CVSS 8.8) that lets a crafted file evade Mark of the Web (MOTW), the tag Windows attaches to internet-sourced files so that SmartScreen and Office Protected View treat them with suspicion. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog with an October 16 remediation deadline for federal agencies. The publicly disclosed CVE-2026-108398 (CVSS 8.8) lets an authenticated attacker bypass Windows Defender Application Control (WDAC) by getting a protected process to load a crafted .NET assembly.

Why a MOTW bypass deserves day-one attention  

Last month’s exploited zero-days were elevation-of-privilege flaws, which comes second in an intrusion chain. CVE-2026-96951 comes first. MOTW is the check that makes Windows treat a downloaded file or email attachment as untrusted, so bypassing it removes the warning a user would otherwise see before opening that file. Microsoft’s advisory describes the attack path as a crafted file sent by email or instant message to a user who is then persuaded to open it.

Windows has faced the same class of flaw before. In 2024, CVE-2024-29988 let attackers hide a malicious file inside an archive so it slipped past endpoint and network detection tools and SmartScreen prompts. It was one of 26 Microsoft zero-days that year, out of around 90 reported across all vendors.

Once the file runs, the attacker gains a foothold on a workstation. On a machine still missing the .NET Framework update, CVE-2026-108398 gives that attacker a way to run code inside a protected process that WDAC was supposed to restrict. An unpatched privilege-escalation flaw like September’s then takes them to SYSTEM, where credential theft and lateral movement toward domain admin begin. Every step in that chain depends on a patch that hasn’t been deployed yet.

Lesson 1: Security-control fixes need security-control testing  

Both of this month's zero-days sit inside the mechanisms that decide whether a file is trusted or a binary is allowed to run. When a patch changes how MOTW or WDAC behaves, the failure to watch for is a control that silently stops working, or one that starts blocking files and applications your users depend on. A pilot machine that installs the update and reports success tells you neither.

Build the pilot around what the fix touches. For the Windows Shell update, include machines where users open email attachments, extract archives, download files through the browser, and launch files from shared drives, then confirm the security warning still appears on a file you download yourself. For the .NET Framework update, include at least one machine running your production WDAC or AppLocker policy and confirm your signed line-of-business applications still launch. Your IT team's own laptops, the usual choice of pilot group, rarely run the strictest application control policy in the environment.

The Test and Approve workflow in ManageEngine Patch Manager Plus deploys patches to a test group first and can approve them automatically for wider rollout after a set period. Its success check confirms installation. So for fixes like these two, choose test group members deliberately and hold approval until someone has checked the control itself.

Lesson 2: File-handling endpoints belong at the front of the queue  

Exposure-based prioritization usually starts with internet-facing servers. CVE-2026-96951 needs a user to open a crafted file or click a link, so the machines most at risk are the workstations where people handle email and downloads every day, many of which never face the internet directly.

The same reasoning applies to CVE-2026-21413, a non-Microsoft flaw (CVSS 9.8) in the Raw Image Extension that Microsoft shipped a fix for this month. Windows can trigger it while generating a thumbnail or preview, so you only have to browse to a folder containing a malicious RAW image.

Put the workstations that handle external files in your first deployment wave alongside internet-facing servers, and treat a missing Windows Shell update on those machines as a day-one gap.

Lesson 3: Microsoft's risk cohorts give your triage a head start  

Alongside the release, Microsoft introduced risk cohorts: provisional groupings of CVEs that call for the same assessment of your environment, whatever their root cause or CVSS score. October's release maps to 15 cohorts, the largest covering Windows filesystems, storage, and backup (136 CVEs); Office documents and mail clients (135); Windows graphics, media, and content processing (131); and Windows core and kernel privilege boundaries (109).

Each cohort comes with a question you answer once for the whole group. For the remote access and RDP cohort, the question is whether you run RD Gateway or RD Session Host roles that are reachable from outside the corporate network. If your RDP endpoints sit behind a VPN or Zero Trust access path, part of that cohort can move down your queue without a CVE-by-CVE review.

Microsoft describes the cohorts as experimental and says they do not replace review of exploited or high-severity flaws. Use them to cut repeated environment analysis, and keep exploited status as the override.

Lesson 4: October was the last security update for some of your devices  

On October 13, Windows 11 version 24H2 Home and Pro and Windows 10 Enterprise LTSB 2016 received their final security update. If your organization runs on Windows 11 version 23H2 Enterprise or Education, you have until November 10. A device on one of these versions will look fully patched against October's release and then fall further behind every month, because Microsoft will publish nothing new for it.

Mixed fleets need a closer look. Windows 11 version 24H2 Enterprise and Education stay supported until Oct. 12, 2027, so two machines showing the same version number can sit on different support timelines depending on edition. Microsoft also auto-upgrades unmanaged Home and Pro devices to 25H2, while IT-managed devices wait for you, which makes the Pro machines in a small office the likeliest to drift out of support unnoticed.

For each affected device, pick a path: an in-place upgrade to a supported release, a paid Extended Security Updates (ESU) subscription where eligible (LTSB 2016 needs its own ESU purchase), isolation from sensitive systems, or retirement. Patch Manager Plus deploys Windows 11 feature packs, including 25H2, from the same console and automated deployment tasks you use for monthly patches, so the upgrade path needs no separate tool.

What October adds to the playbook  

September's lessons were about keeping pace with volume. October's come down to knowing your environment well enough to see which machines a given fix actually matters for, from the workstation that opens attachments all day to the laptop that quietly fell out of support on October 13. If that view is hard to assemble today, see how Patch Manager Plus builds it before November 10, when the next Patch Tuesday and the next end-of-support date land on the same day.