One flaw under attack, more than 1,400 fixes
October's Patch Tuesday (October 13, 2026) is the largest in Microsoft's history. Depending on how they are counted, it covers 1,407–1,415 vulnerabilities, about 70 of them rated critical. Only one is being exploited in attacks: CVE-2026-96951 in Windows Shell. Two more were publicly disclosed before the fixes shipped, with no confirmed attacks.
With this many patches, reviewing each one is not possible. The key point for a company: all Windows flaws are fixed by one cumulative update per system, so rollout order is decided by which machines are most exposed to attack.
CVE-2026-96951: bypassing Mark of the Web
Files downloaded from the internet or received by email get the Mark of the Web tag in Windows. It makes the system show a warning, lets SmartScreen check the file, and makes Office open the document in Protected View and block macros. The Windows Shell flaw (CVSS 8.8, rated "Important" by Microsoft) lets an attacker craft a file so that these protections do not kick in. The victim has to click a link or open an attachment, so this is a typical phishing tool. The flaw does not spread across the network on its own.
CISA added the flaw to its KEV catalog on the day the fix was released and gave federal agencies three days to apply it. No attack details have been published. All supported Windows versions are affected, from Windows 10 and Server 2012 R2 to Windows 11 26H2 and Server 2025.
Rollout order
Right away
- Workstations, especially laptops of people who receive external email: the CVE-2026-96951 fix and the Office updates.
- Outlook: CVE-2026-70291 and CVE-2026-88156 (CVSS 9.8). According to Microsoft, simply displaying a message in the Reading Pane is enough, without opening or clicking anything. There are no exploits yet, but this type of bug attracts attackers quickly.
- On-premises Exchange Server: CVE-2026-70571, a stack overflow triggered by a crafted email, no login required. The attack is difficult (AC:H), but Microsoft rates exploitation as "More Likely".
In the next maintenance window (this week)
- Domain controllers: CVE-2026-70229 in AD DS, unauthenticated remote code execution, "Exploitation More Likely".
- Servers with the DHCP role (CVE-2026-96934, CVSS 9.8) and the MSMQ service (CVE-2026-100202, CVSS 9.8, TCP port 1801). MSMQ is not installed by default, but it often lingers after old applications.
- Hyper-V hosts: CVE-2026-102214 lets code in a guest VM run on the host. It matters where one host runs VMs with different trust levels.
- RD Gateway (CVE-2026-70187) and SharePoint Server (CVE-2026-102866, impersonating a user with a modified token).
- .NET Framework: CVE-2026-108398, a publicly disclosed Windows Defender Application Control bypass. Relevant for companies that rely on WDAC.
How to check the patches are in place
October cumulative updates:
- Windows 11 24H2, 25H2 and 26H2: KB5127648 (builds 26100.9711, 26200.9711, 26300.9711); 23H2: KB5126653; 26H1: KB5127646;
- Windows 10 22H2/21H2 (ESU): KB5126657;
- Windows Server 2025: KB5126646 (26100.33650); 2022: KB5126655; 2019: KB5126651; 2016: KB5126868; 2012 R2 (ESU): KB5126836;
- Exchange: KB5128895 (Subscription Edition RTM), KB5128896 (2019 CU15), KB5128897 (2019 CU14), KB5128898 (2016 CU23).
On a single machine, winver (build number) or Get-HotFix -Id KB5127648 in PowerShell is enough. In WSUS, check the status report for these KBs; in Intune, the Windows quality update report. Office from the Microsoft 365 channel updates itself, but check the version under File → Account on a few computers.
What happened after October 13
The biggest problem affects companies running their own Exchange. The October updates for Windows Server 2016–2025 introduced a limit of 512 simultaneous Endpoint Mapper calls, too low for a busy Exchange server. Symptoms: OWA sign-in failures, messages stuck in the Outbox, growing queues, a MapiExceptionMdbOffline (ec=1142) error and event 1006 in the application log. The problem can appear only after several days. Microsoft advises against uninstalling the update and provides a temporary workaround (restart the server afterwards):
reg add "HKLM\SOFTWARE\Microsoft\Rpc" /v EpmapSavedContextCap /t REG_DWORD /d 65536 /f
As of October 22 there was no fix or out-of-band update for this bug. Microsoft released out-of-band update KB5133047 on October 16, but it only covers the out-of-box experience (OOBE) of Windows 11 26H1 and is not a security fix.
On Windows 11, Microsoft also documented an RDP failure for non-admin users connecting to computers with Administrator protection enabled (error 0xC000000D). For Windows 11 24H2 Home and Pro, the October patch is the last one; such machines in a company should be moved to 25H2.
The longer-term lesson
More than a thousand fixes a month means reading bulletins by hand no longer works. You need an inventory of servers and their roles (DHCP, MSMQ, AD DS, RD Gateway, Exchange), automatic rollout to workstations in the first days after release, and a test group that catches problems like the Exchange one before they reach every server.