Microsoft’s October 2026 Patch Tuesday is the 12 months’s largest launch, with 1,408 CVEs requiring buyer motion, 72 of them rated essential. September, the earlier excessive, carried 963. One CVE is already exploited: CVE-2026-96951, a Home windows Shell flaw that bypasses Mark of the Internet. Two have been publicly disclosed earlier than launch, within the .NET Framework and the MessagePack-CSharp library. Individually, on 25 September Microsoft reported assaults in opposition to CVE-2026-65660, a SharePoint Server flaw fastened in August. Readiness recommends a Patch Now scheduling for Home windows, Workplace, Trade and the developer tooling, and an ordinary launch schedule for SQL Server. The Readiness crew has printed an infographic summarising deployment danger by product household.
Identified points
On 14 October, Microsoft added a identified situation to this month’s Home windows 11 updates, KB5127648 for variations 24H2, 25H2 and 26H2, and KB5127646 for 26H1. Non-admin customers is likely to be unable to open Distant Desktop connections to gadgets which have Administrator safety enabled, with error 0xC000000D. The problem began with September’s non-security preview replace. The Home windows 11 safety baselines allow Administrator safety by default, so take a look at distant entry to managed hosts earlier than broad deployment. Microsoft’s mitigation is to show off Administrator safety briefly by means of your coverage administration instrument, and a repair will observe in a future replace.
Two points stay open:
