Microsoft’s October 2026 Patch Tuesday is the year’s largest release, with 1,408 CVEs requiring customer action, 72 of them rated critical. September, the previous high, carried 963. One CVE is already exploited: CVE-2026-96951, a Windows Shell flaw that bypasses Mark of the Web. Two were publicly disclosed before release, in the .NET Framework and the MessagePack-CSharp library. Separately, on 25 September Microsoft reported attacks against CVE-2026-65660, a SharePoint Server flaw fixed in August. Readiness recommends a Patch Now scheduling for Windows, Office, Exchange and the developer tooling, and a standard release schedule for SQL Server. The Readiness team has published an infographic summarising deployment risk by product family.
Known issues
On 14 October, Microsoft added a known issue to this month’s Windows 11 updates, KB5127648 for versions 24H2, 25H2 and 26H2, and KB5127646 for 26H1. Non-admin users might be unable to open Remote Desktop connections to devices that have Administrator protection enabled, with error 0xC000000D. The issue started with September’s non-security preview update. The Windows 11 security baselines enable Administrator protection by default, so test remote access to managed hosts before broad deployment. Microsoft’s mitigation is to turn off Administrator protection temporarily through your policy management tool, and a fix will follow in a future update.
Two issues remain open:
