October 2026 Patch Tuesday: A Record 1,400 Fixes, 3 Zero-Days, and What a Small Business Needs to Do

Microsoft released its October security updates this morning at 10 AM Pacific, and the total broke September's record by nearly half again. Three of the flaws count as zero-days: one already being exploited and two that were public before a fix existed. Most of what you will read about this release is the number. The number is not the risk. Here is what actually shipped, the one flaw in it that attackers are already using, and what we are doing about it this week for clients across Salinas and Monterey County.

What this month means for a small business

The blind spot most owners have with a release like this is the size. A 1,400-fix month sounds like a 1,400-alarm month. It is not. Of the 1,417 items Microsoft published today, exactly one is confirmed to be under attack, and it needs a person to open a file to work. Most of the rest are bugs that researchers found with automated tools in corners of Windows and Office that nobody in a packing shed, a clinic, or a dispatch office will ever touch directly.

What a month this size actually tests is whether your patching has an owner and a verification step. A release that touches this much of the operating system gives a bad patch more places to hide, and it gives a machine that quietly stopped updating in July more to miss. The question to ask your IT provider is not "did you hear about the 1,400 bugs." It is "which of our machines are confirmed on this month's build, and which are not."

The second blind spot is "the computer said it updated." A patch that downloaded but never rebooted into place protects nothing. And Office does not update through the Windows update at all. It has its own channel, so a PC can be fully current on Windows and still be running vulnerable Outlook. That distinction matters more this month than most, because the fixes that do not need a click are mostly in Office.

One more thing before the details. The front-desk PC at a clinic, the office computer in an agriculture operation, the quoting workstation on a manufacturing floor, and the laptop a transportation dispatcher carries home are the same risk here: a person with email and a browser. The industries are different. The attack path this month is not.

The one flaw being exploited: a file that skips Windows' warning

When you download a file from the internet, Windows attaches an invisible tag to it called Mark of the Web. That tag is why Word or Excel opens the file in Protected View with a yellow bar across the top, and why Windows asks "are you sure" before running something you downloaded. It is the last safety net for an employee who clicks on the wrong thing.

CVE-2026-96951 removes that net. Microsoft describes it as a command-injection flaw in Windows Shell that lets an attacker "bypass a security feature over a network," and its own advisory is specific that the feature being bypassed is Mark of the Web. The attack scenario Microsoft lays out is ordinary phishing: a crafted file sent by email or instant message that the attacker has to convince someone to open. Microsoft rates it Important, not Critical, with a CVSS score of 8.8, and marks it as exploited but not publicly disclosed, so the details are not sitting in a public write-up yet. Microsoft has not said who is using it or against whom.

CISA, the federal cybersecurity agency, added it to its Known Exploited Vulnerabilities catalog the same day, with an October 16 deadline for federal agencies to patch. Three days is a tight window, and a good signal for how seriously to take this one.

Here is why it matters for a small business specifically. Your defense against a phishing email has always been two layers: the person, and the warning Windows shows if the person slips. This bug takes the second layer away. So until the patch is on every machine, which for our clients is Friday morning, the first layer is doing all the work. That is what the staff guidance further down is for. The fix itself rides in this month's cumulative update for every supported version of Windows, from Windows 10 with Extended Security Updates through Windows 11, and from Windows Server 2012 R2 through Windows Server 2025.

The fixes that matter, at a glance

Out of 1,417 items, this is the short list we are actually working from. CVSS is the industry's 0-to-10 severity score; "exploited" is whether Microsoft confirms real-world attacks.

Why the patch count keeps climbing while the list that matters stays short

Until this year Microsoft had never fixed more than about 200 flaws in a month. Then AI-assisted bug hunting arrived on every side, a shift we covered when an AI model found 271 vulnerabilities in Firefox. July hit 570, August 400, September 966, and now October has cleared 1,400. Microsoft is openly using AI platforms to find and fix flaws in its own products, as BleepingComputer's October roundup notes, which is the main reason the number keeps rising.

Here is the part that should lower your blood pressure. Bugs found in bulk by automated tools are mostly bugs in deep, rarely used code paths. They are real and they deserve fixing, but the number of flaws per month that attackers are actually using has stayed between one and three all year, through 200-bug months and 1,400-bug months alike. The signal that matters has not grown with the noise.

The counting itself has gotten harder, which is why you will see 1,409, 1,411, and 1,415 in different headlines. Microsoft's Security Update Guide no longer publishes one simple list, so every outlet applies its own rules. We use Microsoft's own data: 1,417 items published on October 13, of which one is an advisory and two are entries Microsoft marks as not a vulnerability, leaving 1,414 real fixes. Counting the 342 items Microsoft published earlier in the month, most of them cloud services and open-source components it patches server-side, the October release note holds 1,759 entries. Microsoft also started grouping this month's fixes into fifteen experimental "risk cohorts" to help with prioritization, the largest being 136 flaws in Windows file systems, storage, and backup, and 135 in Office documents and mail clients.

Our own filter is simpler and it is the one the table above follows. Exploited first. Publicly disclosed second. Then anything Microsoft rates "exploitation more likely," which is 108 items this month. Then anything reachable from the internet with no login. Then anything a preview pane can trigger. Everything else gets installed on schedule and verified, which is what a patch management process is for.

Four support deadlines landed on the same day

• Windows 11 version 24H2, Home and Pro editions, reached end of updates today. Microsoft's announcement says the October 2026 security update is the last one those editions will receive. Enterprise and Education editions of 24H2 are supported until October 12, 2027. Most small business PCs run Pro, so this is the one that applies to you. The fix is a free move to Windows 11 version 25H2 or 26H2, which installs like a monthly update with one restart. We run that as its own pass, separate from Thursday's security update.
• Windows Server 2022 left mainstream support today and moved to extended support. In plain terms: it keeps getting monthly security updates at no extra cost through October 14, 2031, and loses new features and non-security fixes. Nothing changes for your patching.
• Windows Server 2012 and 2012 R2 got their final update today. The third and last year of Extended Security Updates ended October 13, 2026, and Microsoft says this month's update is the last one those servers will ever receive. If one of these is still running in your building, it is now permanently unpatchable, and the conversation we started in June is now a deadline that has passed.
• Windows 10 only gets this update through Extended Security Updates. KB5126657 shipped only to enrolled machines. The good news from last month holds: Microsoft has extended the Windows 10 ESU program through October 12, 2027, so an unenrolled machine can still be brought in. It is a bridge, not a plan. The Windows 10 ESU post and the end-of-life post lay out the exit paths.

Two more for the calendar: Windows 11 version 23H2 Enterprise and Education editions reach end of updates on November 10, 2026, and the next Patch Tuesday is the same day.

Our rollout this week

We do not push a release this size to production on Tuesday afternoon. Patches occasionally break things, and when they do, the industry finds out within a day or two as millions of machines install them. A release with this many fixes touches more of the operating system and gives a regression more places to hide, so the roughly 48-hour soak is worth more this month, not less. The one exploited flaw needs a person to open a file, which means the soak costs little as long as people are careful for two days. That is the trade we are making, and the staff guidance below is the other half of it.

Workstations: Thursday, October 15, after hours. The cumulative update goes to every managed PC once the first wave of installs looks clean. Reboots are scheduled for early Friday morning, before the first shift, so nobody loses work to an "installing updates" screen. Machines need to be on and plugged in Thursday night. Laptops that are off the network, which in transportation and agriculture is common, pick up the update the next time they connect, and we track the stragglers by name rather than assuming they caught up.

Servers: the normal after-hours maintenance window. On-premises Exchange goes first, for both of this month's Exchange flaws. Any server running the DHCP role goes next, which in a small office usually means the domain controller. Each server gets a backup checkpoint before the update and a reboot one at a time, so a file share or a line-of-business application is never down in the middle of an invoice run, a shift change, or a dispatch board update.

Office: its own pass. Office updates ship on their own channel, so a machine can be fully current on Windows and still be running vulnerable Outlook, Word, and PowerPoint. The Office pass is where the preview-pane flaws get closed, and we verify the installed Office version on each machine afterward instead of trusting the Windows Update checkmark.

Verification, not assumption. After the reboot, our management tools confirm per machine that the update applied, the build number moved, and the machine came back healthy. For the person who looks after your systems, the numbers to check are 26100.9711, 26200.9711, or 26300.9711 on Windows 11 (versions 24H2, 25H2, and 26H2, all from KB5127648), 22631.7652 on Windows 11 23H2, 19045.7807 on Windows 10 with ESU, 26100.33650 on Windows Server 2025, and 20348.5761 on Windows Server 2022. Clients get the specific windows by email, so none of the above requires anything from you.

What your staff should do this week

1. Leave computers on and plugged in Thursday night. Expect a restart early Friday morning. Save your work before you leave.
2. Treat unexpected attachments and download links with extra suspicion until Friday. The warning you normally rely on when you open a downloaded file is exactly what the exploited flaw skips. If a file opens with no yellow bar and no prompt, that is not reassurance.
3. Do not preview mail from senders you do not recognize. Five Outlook flaws this month can fire from the Reading Pane alone. If your office wants the reading pane turned off for outside mail until the Office pass lands, we can push that setting centrally rather than asking each person to change it.
4. If a document asks you to "enable content" or "enable editing," stop and call. That request has been the start of more incidents than any other single click.
5. Do not accept a Windows upgrade prompt on your own. Some PCs will start offering Windows 11 version 26H2. We schedule feature upgrades separately so they never land on a workday.
6. If you already clicked, say so immediately. The first-hour checklist covers what happens next. Nobody has ever been in trouble for reporting early.

If your team has not had a refresher lately, this is a good month to run one, and the security awareness training post covers how to do it without wasting an afternoon.

Where this fits

• The September 2026 Patch Tuesday post, the August post, and the July post, for the three previous releases and the patch-cadence habit.
• The AI-found Firefox flaws post, for the discovery wave behind 2026's record volumes.
• The clicked-a-phishing-link post, for the first hour after the one click this month's exploited flaw depends on.
• The EDR versus antivirus post and the managed detection and response page, for catching what a skipped warning lets through.
• The exposed RDP post and the May SharePoint post, for why anything reachable from the internet moves up the list.
• The Windows 10 ESU post and the Windows 10 end-of-life post, for the machines this release skipped.
• The patch management post, for the ownership and verification structure that makes a 1,400-fix month routine.
• The healthcare, agriculture, manufacturing, and transportation IT pages, for how patching fits each industry's hours and compliance rules.
• The managed IT page and the pricing page, for patch management that is verified across every device and what it costs.

We run monthly patch management for small businesses across Salinas, Monterey, Watsonville, Santa Cruz, and San Jose, and the rest of the Central Coast. This is the kind of thing we watch so you do not have to.

FAQs about the October 2026 Patch Tuesday

How many vulnerabilities did the October 2026 Patch Tuesday fix?

It depends on what you count, which is why the headlines disagree. Microsoft's own October 2026 release note lists 1,417 items published on October 13. One of those is an advisory rather than a vulnerability and two are entries Microsoft itself marks as not a vulnerability, which leaves 1,414 real fixes. Add the 342 items Microsoft published earlier in the month, most of them for cloud services and open-source components it patches on its own side, and the full October note runs to 1,759. Trackers that count only release day land between 1,409 and 1,415 depending on what they exclude. Any way you count it, this is the largest Patch Tuesday on record, well past September's 966. Of the release-day items, 70 are rated Critical, and 108 carry Microsoft's "exploitation more likely" rating.

What is the zero-day being exploited, and does it affect us?

CVE-2026-96951 is a security feature bypass in Windows Shell, rated Important with a CVSS score of 8.8. Microsoft confirms it is being exploited and that it lets an attacker evade Mark of the Web, the hidden tag Windows attaches to anything downloaded from the internet. That tag is what makes Office open a downloaded file in Protected View and makes Windows warn before running it. The attack still needs a person to open a crafted file sent by email or chat, so it is a phishing bug, not a worm. It affects every supported Windows version from Windows 10 (with Extended Security Updates) through Windows 11 and Windows Server 2012 R2 through 2025. CISA added it to the Known Exploited Vulnerabilities catalog on October 13, 2026 with a federal remediation deadline of October 16. This month's cumulative update fixes it, so the answer for a managed client is yes, it affects you, and it is patched in this week's rollout.

Do we need to do anything about the Partner Center, Bookings, or Azure flaws with the perfect 10 scores?

No. CVE-2026-96207 in Microsoft Partner Center (CVSS 10.0), CVE-2026-94510 in Microsoft Bookings (9.9), CVE-2026-77900 in Azure App Service (9.8), CVE-2026-88131 in Microsoft Dataverse (9.8), and three other cloud-service CVEs were published ahead of Patch Tuesday and are all rated Critical. Microsoft's advisory for each one says the same thing: the vulnerability has already been fully mitigated by Microsoft and there is no action for users of the service to take. They exist for transparency. They will show up in any article that sorts by score, which is why we mention them, but there is nothing to install.

We still run Exchange on-premises. What should happen first?

Two things this month, in this order. First, CVE-2026-96940, an elevation-of-privilege flaw Microsoft rates "exploitation more likely", shipped early on October 2 in a re-released September security update for Exchange Server 2016 CU23, Exchange Server 2019 CU14 and CU15, and Exchange Server Subscription Edition. It lets a logged-in user read other people's mailboxes in the same organization. If that update was not applied, it is two weeks late. Second, today's October security update for the same four versions fixes CVE-2026-70571, a Critical remote code execution flaw an attacker can trigger by sending the server a crafted email, with no user action. Microsoft also rates it "exploitation more likely" while noting it is hard to pull off. Exchange Online customers need to do nothing for either; Microsoft fixed its side. Exchange 2016 and 2019 only receive these updates if you bought the Extended Security Update program, since both products left support in October 2025.

Our PCs are on Windows 11 24H2. Did we just lose support?

If they run the Home or Pro edition, yes. Microsoft announced on October 13, 2026 that Windows 11 version 24H2 Home and Pro have reached end of updates, and that the October 2026 security update is the last one those editions will get. Enterprise and Education editions of 24H2 stay supported until October 12, 2027. Most small business PCs run Pro, so the fix is a free in-place move to Windows 11 version 25H2 or 26H2, which installs like a monthly update and needs one restart. We schedule that as its own pass rather than bundling it with this week's security update, so a feature upgrade never surprises anyone on a workday. Do not accept an upgrade prompt on your own; let us schedule it.

When will our machines be patched, and will it interrupt work?

For managed clients, workstations get this month's update Thursday evening, October 15, after hours, with the reboot scheduled for early Friday morning before the first shift. Leave the computer on and plugged in Thursday night. Servers are patched in their normal after-hours maintenance window, with on-premises Exchange and any server running the DHCP role first. Office updates ship on their own channel, so they go out as a separate pass and we verify the installed version on each machine afterward. Laptops that are off the network catch up the next time they connect, and we track the stragglers. The roughly 48-hour gap between release and rollout is deliberate: it lets the first wave of installs surface any bad patch before it reaches your fleet.

Sources: Microsoft Security Update Guide, October 2026 · CISA Known Exploited Vulnerabilities catalog · Zero Day Initiative · BleepingComputer · Windows message center · Windows 11 release information · Windows Server 2022 release health · Windows Server 2012 R2 ESU overview · Exchange Server build numbers · Windows 10 ESU program

Prefer to talk first? Email sales@ghosxt.com or call (831) 204-0501.