Microsoft October 2026 Patch Tuesday: 1,410-CVE Launch Cohort, Exploited Shell Bypass, and 10 Windows OS KBs

Microsoft released its October 2026 security updates on Tuesday, October 13—not today, October 14—and this is an unusually large, high-priority patch cycle. Microsoft’s release note declares 1,413 Microsoft CVEs plus one republished Cisco Talos CVE, while a reproducible exact-launch-timestamp query contains 1,410 CVEs, including 79 Critical issues.^[1][2]

Reporting cutoff: October 14, 2026 at 2:05 p.m. EDT (18:05 UTC). MSRC, CISA and Windows release-health sources were rechecked immediately before the publication gate. Microsoft may revise live feeds and known-issue pages afterward.

Why the totals disagree—and which numbers this guide uses

There is no single honest number unless the cohort is named. Microsoft’s human release note declares 1,413 Microsoft CVEs and separately identifies one republished non-Microsoft CVE, CVE-2026-21413 from Cisco Talos. Its product-family rows sum to 1,413; its displayed total is 1,414, but the note does not publish a 1,414-ID membership list.^[1]

The launch cohort contains 674 elevation-of-privilege, 316 remote-code-execution, 252 information-disclosure, 72 denial-of-service, 40 security-feature-bypass, 29 tampering and 27 spoofing CVEs. These are one-CVE/one-impact counts, not affected-product or KB totals.^[2]

Secondary reports of 1,411, 1,414, 1,416 and 1,417 are therefore snapshots with different filters. The reproducible interpretations are: 1,411 same-day non-Mariner records when ADV260001 is included; 1,414 as Microsoft’s declared release-note total; 1,416 Microsoft-CNA CVEs across the monthly tag; and 1,417 when ADV260001 is added to that Microsoft-CNA set. Some historical specialist tables drifted as MSRC revised the live feed, and a small residue between published snapshots cannot be assigned confidently without their exact historical queries. We preserve that unresolved scope/filtering difference rather than silently choosing the most dramatic total.^[2][20]

The exploited issue: CVE-2026-96951

Publicly disclosed, but not detected exploited

• CVE-2026-108398 — .NET Framework / WDAC bypass: Important, CVSS 8.8. Microsoft says an authenticated local attacker could register and load a crafted assembly in a protected process, bypassing Windows Defender Application Control. This is a post-access control-boundary issue, not an unauthenticated internet entry point.^[5]
• CVE-2026-92707 — MessagePack-CSharp denial of service: Moderate, CVSS 5.3. A network-reachable application that deserializes untrusted MessagePack input may be vulnerable to memory exhaustion. It is an availability flaw, not code execution, and GitHub is the CNA.^[6]

Critical issues to prioritize by real exposure

CVE-2026-21413 is the single republished external CVE called out by Microsoft. Cisco Talos is the CNA; Microsoft’s remedy points to Store application updates. Do not count it as Microsoft-authored, and do not assume a Windows cumulative update alone proves that the extension is current.^[7]

Official Windows KB and build table

Scope: this is the complete 10-package ledger for production Windows client and Windows Server operating-system cumulative security updates and Monthly Rollups. It intentionally excludes separate .NET, Office, Edge, Defender intelligence, Dynamic Update and standalone app/component packages. Phone readers: swipe this table left. One KB can fix many CVEs, and one CVE can map to several product-specific packages. Install only the package applicable to the actual Windows edition and servicing channel.^[8]

Lifecycle deadlines that change the patch decision

• Windows 11 24H2 Home/Pro: KB5127648 is the final monthly security update. Move eligible devices to 25H2 or 26H2; installing October’s package does not extend servicing.^[8][18]
• Windows 10 2016 LTSB: KB5126868 is the final free update for those client editions. Windows Server 2016 remains on a different lifecycle.^[13][19]
• Server 2012/R2: KB5126835 and KB5126836 close Year 3 ESU. Treat migration, retirement or strongly bounded isolation as required follow-up—not as an optional housekeeping task.^[16][17]

Windows Server 2022 lifecycle: mainstream support ended October 13, 2026, but the product entered extended support rather than becoming unpatched; extended support runs through October 14, 2031.^[14]

Known issues and installation prerequisites

• Windows 10 22H2/21H2: install the latest SSU. Offline images older than KB5028244 first need SSU KB5031539; WSUS/Catalog deployments older than KB5003173 first need SSU KB5005260.^[11]
• Windows 10 1809 / Server 2019: KB5005112 is a prerequisite.^[12]
• Windows 10 1607 / Server 2016: approve/install SSU KB5126649 before KB5126868.^[13]
• Server 2022 offline servicing: the image needs KB5030216 or later, minimum SSU build 20348.1960.^[14]
• Server 2012 R2 / 2012: install SSU KB5127356 / KB5127357 before the Monthly Rollup.^[16][17]

For updated installation media, follow Microsoft’s boot.stl warning: use the Update WinPE script or copy the matching file into the media. Microsoft warns that omission can prevent the media from starting with error 0xc0430001.^[8][11]

Deployment channels and a safe rollout sequence

Microsoft lists Windows Update/Microsoft Update, Windows Update for Business, Microsoft Update Catalog and WSUS as deployment paths, depending on the package. Current Windows 11 cumulative updates normally include the current servicing stack; older branches can retain standalone prerequisites.^[8][11]

Home-user action plan

1. Save your work and confirm that irreplaceable files have a current backup.
2. Open Settings → Windows Update and install the update offered for your exact branch. Do not download a random KB merely because its number appears in this guide.
3. Restart when prompted. October is a hotpatch baseline month for eligible devices, so a reboot is expected.
4. Run winver and compare the build with the table. Also check Windows Update → Update history for the KB.
5. Test sound, printing, VPN, fingerprint sign-in and Remote Desktop if you use them. Record the exact error before uninstalling anything or changing security settings.
6. If you run Windows 11 24H2 Home/Pro, move to a supported Windows release after confirming compatibility.

IT-admin action plan

1. Inventory: record edition, build, installed roles/features, internet and segment reachability, IPv4/IPv6 listeners, package origin, image/container provenance where applicable, and lifecycle exceptions.
2. Preserve rollback and evidence: confirm tested backups and recovery media. If compromise is suspected, preserve volatile and short-retention evidence while containing the system—before upgrades, key rotation or cleanup erase useful timelines.
3. Pilot: include endpoint protection, VPN, USB audio, printing, non-admin RDP to Administrator-protected hosts, identity/mail roles, failover nodes, line-of-business apps and offline-media workflows.
4. Deploy in rings: pilot, representative business cohort, then broad rollout. Accelerate CVE-2026-96951 exposure after the pilot passes.
5. Replace every runtime: confirm old workers, VMs, replicas, nodes and regions are restarted or otherwise running the patched artifact; a patched file on disk does not prove every process is protected.
6. Verify: compare installed KB/build, effective configuration, listeners, functional behavior, logs and availability metrics. Check secondary regions, load balancers and stale replicas.

How to verify the result

• Confirm the active OS build with winver and the installed KB through Update History or your management inventory.
• For 23H2 Enterprise/Education, expect build 22631.7652; Microsoft’s KB heading currently shows the inconsistent 22621.7652 value, while release health and remediation data support 22631.7652.^[10][18]
• Verify required SSUs on legacy lines and the cumulative package or Monthly Rollup.
• Check that no old process, container, node or replica remains active on the previous runtime.
• Retest RDP, audio, printing, VPN, identity, mail flow and applications represented in the pilot.
• Review logs and monitoring after rollout; “deployment succeeded” is not the same as “the intended build is running everywhere and services are healthy.”

Reproducible research method

Open the cohort and package methodology

The CVE ledger deduplicates by CVE ID, excludes non-CVE advisory ADV260001 from CVE counts, separates the exact release-note timestamp from the whole calendar date, and records Microsoft severity, impact, CNA, exploit/public-disclosure flags and product mappings. The exact-date set adds 10 earlier third-party October 13 publications whose Microsoft severity and impact fields are unstated. The current CVRF and live SUG monthly feed are broader moving feeds and are not relabeled as launch counts.

The package ledger is separately reconstructed from the ten official KB pages and Windows release-health tables. It preserves applicable products, builds, prerequisites, known issues and lifecycle status. Server 2012/R2 builds remain “not stated” rather than inferred. The article intentionally does not dump all 1,900-plus moving-feed records into the reader view; the official live feed remains the auditable inventory source.

Frozen research cutoff before the final live recheck: October 14, 2026 at 1:57 p.m. EDT (17:57 UTC). Final article cutoff: 2:05 p.m. EDT (18:05 UTC).

Frequently asked questions

Was October 14 Patch Tuesday?

No. Microsoft released the monthly security updates on Tuesday, October 13, 2026. This article was researched and published on Wednesday, October 14.

Are there three actively exploited zero-days?

No. Microsoft marks only CVE-2026-96951 as exploited. CVE-2026-108398 and CVE-2026-92707 were publicly disclosed but are not marked exploited. Some outlets use “zero-day” broadly for public-before-fix disclosure; this guide keeps public disclosure and active exploitation separate.^[2][3]

Should I install every KB in the table?

No. Install the cumulative update or Monthly Rollup that matches your edition, version and servicing entitlement. Windows Update or your organization’s approved management channel is the safer default.

Can I roll back if something breaks?

Use a documented, time-bounded rollback only when the business impact demands it and compensating controls are in place. Prefer fixing forward. For a feature-specific problem, a vendor-approved temporary mitigation that retains the fixed binary is safer than restoring a broadly vulnerable runtime.

If your update fails, BitLocker asks for recovery, or a business-critical service breaks, avoid random “repair” utilities. Schedule The IT Guys for practical help in Port Saint Lucie, Jensen Beach, Fort Pierce and Vero Beach.

Sources

1. Microsoft Security Response Center — October 2026 Security Updates release note.
2. Microsoft Security Update Guide — October 2026 vulnerability feed.
3. MSRC — CVE-2026-96951.
4. CISA — Known Exploited Vulnerabilities catalog.
5. MSRC — CVE-2026-108398.
6. MSRC — CVE-2026-92707.
7. MSRC — CVE-2026-21413.
8. Microsoft Support — KB5127648.
9. Microsoft Support — KB5127646.
10. Microsoft Support — KB5126653.
11. Microsoft Support — KB5126657.
12. Microsoft Support — KB5126651.
13. Microsoft Support — KB5126868.
14. Microsoft Support — KB5126655.
15. Microsoft Support — KB5126646.
16. Microsoft Support — KB5126836.
17. Microsoft Support — KB5126835.
18. Microsoft — Windows 11 release information.
19. Microsoft — Windows 10 release information.
20. BleepingComputer — same-day 1,411-record cohort and public-disclosure framing.