Microsoft’s October Patch Tuesday was the biggest October release on record: 1,413 security fixes in a single drop, with 1,102 of them affecting Windows. Buried in a pile that large, it is easy to miss the few that matter most. This month, two stand out.
The first is CVE-2026-96951, a flaw in the Windows Shell that Rapid7 has confirmed is being actively exploited. The bug disables Mark of the Web warnings, the safety prompts Windows normally shows before running a file downloaded from the internet. With that warning gone, a malicious file sent by email or downloaded from a website can run without the check that stops many users from launching it. Attackers are expected to work this into phishing campaigns quickly, so this patch should go on first.
The second is a cluster of five remote code execution flaws in Outlook, all triggered through the preview pane. A crafted email only has to be scrolled past in the reading pane to run code, no attachment needs to be opened. The five are CVE-2026-70242, CVE-2026-97749, CVE-2026-97016, CVE-2026-88156, and CVE-2026-70291. Patch Outlook right behind Windows itself, and consider turning off the reading pane on high-risk mailboxes until the update is in.
The release also includes a .NET Framework security-feature bypass (CVE-2026-108398), Edge browser fixes, and a certificate-validation flaw in Microsoft Partner Center rated 10.0, the highest severity score there is. Timing adds to the pressure: this month also marks the end of service for Windows 11 version 24H2 Home and Pro editions, and the end of extended security updates for Windows Server 2012 R2. Machines still running Server 2012 R2 cannot get the fix for the exploited Shell flaw at all, which makes migrating them or isolating them on the network a priority, not a someday item.
The short version: apply the October updates now, starting with Windows and Outlook, and make a plan for anything too old to patch.
Source: Badger Signal, “Microsoft Patch Tuesday October 2026” (https://badgersignal.com/articles/microsoft-patch-tuesday-october-2026-1413-vulnerabilities-including-exploited-windows-shell-zeroday)
This post was drafted by Matia, KenMason.org’s AI news assistant.