Microsoft October 2026 Patch Tuesday Addresses 1,408 CVEs Including One Exploited Flaw
Microsoft’s largest annual update cycle includes a critical Windows Shell bypass and known issues affecting Windows 11 Remote Desktop access.
Key points
- The release addresses 1,408 vulnerabilities, with 72 rated critical severity.
- CVE-2026-96951, a Windows Shell flaw, is already being exploited in the wild.
- Known issues may block Remote Desktop connections for non-admin users on Windows 11.
Microsoft released its October 2026 Patch Tuesday updates, marking the largest monthly release of the year with 1,408 Common Vulnerabilities and Exposures requiring customer action. According to Computerworld, this volume surpasses the previous high of 963 CVEs recorded in September. The release includes 72 vulnerabilities rated as critical severity, demanding immediate attention from security teams managing Windows and related server infrastructure.
One of the addressed flaws, CVE-2026-96951, is a Windows Shell vulnerability that allows attackers to bypass the Mark of the Web security feature. Microsoft confirmed this specific CVE is already being exploited in the wild. Additionally, two other vulnerabilities were publicly disclosed prior to the release: one in the .NET Framework and another in the MessagePack-CSharp library. These pre-release disclosures highlight the ongoing pressure on software vendors to patch gaps quickly.
Deployment Guidance and Known Issues
Microsoft’s Readiness team recommends a "Patch Now" scheduling approach for Windows, Office, Exchange, and developer tooling products. For SQL Server, they advise adhering to the standard release schedule. An infographic summarizing deployment risk by product family has been published to assist IT administrators in prioritizing their patching efforts based on potential exposure levels.
On 14 October, Microsoft added a known issue to the Windows 11 updates KB5127648 (for versions 24H2, 25H2, and 26H2) and KB5127646 (for 26H1). Non-administrative users may be unable to establish Remote Desktop connections to devices with Administrator protection enabled, encountering error 0xC000000D. This problem originated with September’s non-security preview update.
Affected Systems and Resolutions
Because Windows 11 security baselines enable Administrator protection by default, Microsoft advises testing remote access to managed hosts before broad deployment. The current mitigation involves temporarily disabling Administrator protection through policy management tools, with a permanent fix expected in a future update. Some USB Audio Class 1.0 devices may also fail to start or produce no sound, with Microsoft directing administrators to support for remaining symptoms.
Other fixes include resolving Explorer failures on multi-user systems like Azure Virtual Desktop with FSLogix, which previously left users at a black screen. File History issues on Windows 10, 11 23H2, and Server 2016/2019 are also addressed. Separately, Microsoft reported attacks against CVE-2026-65660, a SharePoint Server flaw fixed in August, on 25 September.
What should you do?
Security teams should prioritize patching systems vulnerable to CVE-2026-96951 immediately due to active exploitation. Administrators deploying Windows 11 updates should test Remote Desktop functionality for non-admin users before rolling out KB5127648 and KB5127646 broadly. Organizations using USB audio devices should monitor for playback issues and consult support if problems persist after the update.
What to do and how to stay safe: Microsoft
- Prioritize patching systems vulnerable to CVE-2026-96951 due to confirmed active exploitation in the wild.
- Test Remote Desktop connectivity for non-administrative users before deploying Windows 11 updates KB5127648 and KB5127646.
- Monitor USB Audio Class 1.0 devices for sound failures and contact Microsoft Support if issues remain unresolved.
- Review the Readiness team infographic to align deployment schedules with product family risk assessments.
Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many vulnerabilities are included in the October 2026 Patch Tuesday release?
The release addresses 1,408 CVEs, with 72 of them rated as critical severity.
Is there a known issue with Remote Desktop in the latest Windows 11 updates?
Yes, non-admin users may encounter error 0xC000000D when connecting to devices with Administrator protection enabled.
Which vulnerability is currently being exploited?
CVE-2026-96951, a Windows Shell flaw that bypasses Mark of the Web, is already being exploited.
