InfoSecBulletin Cybersecurity for mankind
Microsoft breaks its record to its patch history. The company patched record 1411 flaws and 3 zero day of its October 2026 Patch Tuesday. This Patch Tuesday addresses 70 “Critical” vulnerabilities, 57 of which are remote code execution, 11 are elevation of privileges, and 2 are spoofing.
The approximate number of bugs in each vulnerability category is listed below:
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
Anthropic unveils “OSS Scanner” Free AI Vulnerability Scanner for Open-Source Projects
Rise on RCE Exploits Targeting Hikvision Camera Flaw
FortiBleed Attack Compromised 80,000+ Devices, SonicWall Patches 4 SMA1000 Flaws CVSS 10
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
677 Elevation of Privilege Vulnerabilities
40 Security Feature Bypass Vulnerabilities
317 Remote Code Execution Vulnerabilities
254 Information Disclosure Vulnerabilities
73 Denial of Service Vulnerabilities
28 Spoofing Vulnerabilities
Therefore, today’s total does not include 348 flaws fixed earlier this month. These include issues in Azure API Center, Azure App Service, Azure Event Grid, Azure SRE Agent, Mariner, Microsoft Bookings, Microsoft Dataverse, Microsoft Exchange Server, and Microsoft Partner Center.
This Microsoft Patch Tuesday sets a new record as Microsoft keeps using artificial intelligence to find and fix security problems in its products.
Microsoft said today that Windows 11, version 24H2 Home and Pro, and Windows 10 Enterprise LTSB 2016 are no longer supported.
“Today, October 13, 2026, Windows 11, version 24H2 Home and Pro, and Windows 10 Enterprise LTSB 2016 have reached end of updates. The October 2026 monthly security update is the last update available for these editions,” Microsoft said.
Microsoft said earlier this month that groups using Windows 11 23H2 Enterprise, Education, and IoT Enterprise editions need to upgrade. They won’t get security updates starting next month.
To find out more about the non-security updates released today, you can check our articles on the Windows 11 KB5127648 & KB5126653 updates and the Windows 10 KB5126657 security update.
Microsoft patches 2 zero-days
This month’s Patch Tuesday fixes one zero-day vulnerability that is being used by attackers and two others that are known to the public.
Microsoft calls a zero-day flaw public or actively used when there is no official fix. The zero-day problems being used now that were fixed in October 2026 Patch Tuesday are:
CVE-2026-96951 – Windows Shell Security Feature Bypass Vulnerability
Microsoft fixed a security flaw that was being used by hackers. This flaw let them avoid the Mark of the Web security check.
“Improper neutralization of special elements used in a command (‘command injection’) in Windows Shell allows an unauthorized attacker to bypass a security feature over a network,” warns Microsoft.
No details have been shared on how attackers exploited the flaw or who disclosed it.
The two zero-days that were publicly disclosed are:
CVE-2026-108398 – .NET Framework Security Feature Bypass Vulnerability
Microsoft has fixed a security issue in the .NET Framework that let people run unauthorized programs.
“Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally,” explains Microsoft.
Microsoft says this flaw might let attackers get around Windows Defender Application Control (WDAC) rules and run apps that are not allowed.
“An authenticated attacker could place a specially crafted .NET assembly on an affected system and register it for loading by a protected process.” Microsoft says.
“Successful exploitation could bypass Windows Defender Application Control restrictions and allow the attacker to execute code within the protected process. User interaction is not required.”
James Forshaw of Google Project Zero discovered the flaw.
CVE-2026-92707 – MessagePack-CSharp Denial of Service Vulnerability
Microsoft fixed a denial-of-service flaw in MessagePack-CSharp.
“Improperly controlled sequential memory allocation in .NET allows an unauthorized attacker to deny service over a network,” explains Microsoft. Microsoft has not shared who disclosed the vulnerability.
