Microsoft has released software updates as part of its October 2026 Patch Tuesday. The updates fix 1411 security vulnerabilities in total, including 3 zero-day vulnerabilities.
The breakdown of the vulnerabilities are as follows:
477 elevation of privilege
2317 remote code execution
254 information disclosure
28 spoofing
73 denial of service
40 security feature bypass
The actively exploited zero-days are as follows:
CVE-2026-96951 - vulnerability in Windows Shell that can lead to security feature bypass
CVE-2026-108398 - vulnerability in .NET Framework that can lead to security feature bypass
CVE-2026-92707 - vulnerability in MessagePack-CSharp that can lead to denial of service
Why You Should Care?
These vulnerabilities are flaws that have been identified in Microsoft software, and now that they are publicly known, attackers will try to exploit as many targets as possible before users apply the fix. This makes it extra dangerous, and needs to be addressed as soon as possible.
In this case, three zero-day vulnerabilities are being actively exploited or publicly disclosed, which means it is only a matter of time before the attackers compromise your business. Now that patches are available, it is critical to apply the patches as soon as possible to avoid getting compromised.
What Should You Do?
Test the patches ASAP at your organization, and make sure it does not break any business applications
Prioritize the three zero-day vulnerabilities
Roll out the rest of the Patch Tuesday updates