October 2026 Patch Tuesday: 1,411 Flaws, 5 Critical Outlook RCEs

Microsoft shipped fixes for 1,411 vulnerabilities on Tuesday, October 13, 2026, according to BleepingComputer's Patch Tuesday count. September's release, already a record at 966 flaws, now looks small.

Most of the volume is Windows plumbing. The part that matters to anyone with an inbox is narrower: a zero day that defeats the warning Windows puts on files from the internet, and a cluster of Outlook, Word and Exchange bugs that Microsoft says can be triggered by an email.

Key Takeaways

• Microsoft's October 13, 2026 Patch Tuesday fixed 1,411 flaws by BleepingComputer's count, up from 966 in September, with three zero days among them.
• CVE-2026-96951, a Windows Shell bug that lets attackers evade Mark of the Web defenses, is exploited in the wild, and CISA gave federal agencies until October 16 to patch it.
• Five Outlook remote code execution flaws carry a CVSS score of 9.8, and Microsoft says simply viewing a crafted message in the Reading Pane could trigger them.
• Exchange Server received seven fixes this month, including CVE-2026-70571, a Critical bug Microsoft says an unauthenticated attacker can reach by emailing the server.
• Windows 11 version 24H2 Home and Pro got their last security update on October 13, so those PCs need to move to a newer version to stay protected.

How Big Is the October 2026 Patch Tuesday?

It is the largest Microsoft has ever released, though the exact total depends on who is counting. BleepingComputer counts 1,411 flaws and excludes 348 more that Microsoft fixed earlier in October in Azure services, Mariner, Exchange Server and other products. Brian Krebs puts it at more than 1,400, and Cisco Talos counted 1,415.

The Critical count varies even more: 70 by BleepingComputer's tally, "at least 78" according to Krebs, 85 according to Talos. Use the Security Update Guide for your own products rather than any headline number.

Satnam Narang of Tenable told Krebs the month alone beats all of 2020, when Microsoft patched 1,261 CVEs. "We've now crossed the 4,000 CVE mark with two months left to go," he said.

Microsoft has said why. In a July 9 Windows Experience Blog post, it described scanning Windows binaries with an AI system called MDASH and warned: "As AI helps defenders discover more issues, customers will see a higher volume of security updates included in each security release." To help teams cope, the MSRC introduced risk cohorts this month, which are provisional groupings of CVEs that share one environment question. It calls them exploratory and says they "do not change Microsoft update guidance."

What Is CVE-2026-96951, the Exploited Zero Day?

CVE-2026-96951 is a command injection flaw in Windows Shell that lets an attacker evade Mark of the Web, and Microsoft has detected it being exploited. The Microsoft advisory rates it Important with a CVSS score of 8.8, and Krebs reports it affects Windows 10, Windows 11 and some Server versions.

Mark of the Web is the tag Windows adds to files that arrive from an untrusted location. Microsoft's Office documentation says it "is added by Windows to files from an untrusted location, such as the internet or Restricted Zone," and Office relies on it to block macros in email attachments.

Email is named as a delivery route. Microsoft's FAQ says: "In an email or instant message attack scenario, the attacker could send the targeted user a specially crafted file that is designed to exploit the vulnerability." The victim still has to act, by clicking a link or opening the attachment.

Microsoft has not described the attacks. BleepingComputer reported that it had not said who disclosed the flaw, but the advisory's acknowledgments credit four researchers: yhw, two from Fujitsu, and Benoit Sevens, listed as "using Claude with Anthropic." Which of them saw it in the wild is not stated.

CISA added the bug to its Known Exploited Vulnerabilities catalog on October 13 with a due date of October 16, three days. It is the second Windows Shell security feature bypass on that list this year: CVE-2026-21510, also a Windows Shell protection failure, was added on February 10. Microsoft's June release had its own run of zero days, which we covered in Microsoft's June 2026 Patch Tuesday.

Which Outlook Bugs Fire From the Reading Pane?

Five Critical Outlook flaws can, by Microsoft's own description, run code when a crafted email is only previewed: CVE-2026-88156, CVE-2026-97016, CVE-2026-70291, CVE-2026-70242 and CVE-2026-97749. Each scores 9.8, and the FAQ for each repeats the same line: "Simply viewing the message in the Outlook Reading Pane could trigger the vulnerability, without the recipient opening the message or clicking anything in it."

The CVE-2026-88156 advisory answers the question directly: "Yes, the Preview Pane is an attack vector." The five are a mix of stack and heap buffer overflows plus one double free. None is publicly disclosed or exploited, and Microsoft rates all five "Exploitation Less Likely."

Outlook has ten CVEs this month in total. The other five are rated Important and need more from the victim:

• CVE-2026-70282, CVE-2026-70257, CVE-2026-70256: remote code execution that "requires a user to open a specially crafted file."
• CVE-2026-97012: code execution when a user connects Outlook to an attacker's server.
• CVE-2026-70281: an information leak through the Preview Pane that could "read small portions of heap memory."

Mac users should check their edition. For CVE-2026-88156 and CVE-2026-70291, Microsoft says updates for Office LTSC for Mac 2021 and 2024 "are not immediately available" and will follow later.

Word adds 22 more CVEs. Two are Critical with the Preview Pane as a vector, CVE-2026-70269 and CVE-2026-88185, although both are rated high complexity at 8.1. The more interesting one is rated lower. CVE-2026-70300 scores 9.8 and can be triggered by a WordPerfect document "in the Reading Pane; the user does not need to open the document." Microsoft rates it only Important, so it does not appear among the Critical bugs in BleepingComputer's table. We saw the same Word preview pattern in May with CVE-2026-40361.

What Changed for Exchange Server?

Exchange Server has seven CVEs in the October update guide, and one is Critical. CVE-2026-70571 is a stack buffer overflow: "An unauthenticated attacker could send a specially crafted email to an affected Exchange server, triggering an internal content-conversion process." Microsoft says exploitation requires "a deep understanding of the target environment," hence a CVSS score of 8.1, yet it still rates the bug "Exploitation More Likely."

CVE-2026-70279 is a cross site scripting bug rated Important despite a 9.3 score. If an Exchange administrator clicks a crafted link, the attacker can act with that admin's privileges. The remaining four new entries are elevation of privilege bugs.

The seventh, CVE-2026-96940, was published on October 2 and lets a signed in user read other people's mailboxes. We explained it in our CVE-2026-96940 breakdown. Exchange 2016 and 2019 have little time left. The Exchange team said, as quoted by BleepingComputer, that "Once October 2026 ends, there will be no further updates for Exchange 2016/2019, even if you currently have a Period 2 ESU."

What About the Two Publicly Disclosed Zero Days?

Neither is known to be exploited. CVE-2026-108398, found by James Forshaw of Google Project Zero, lets an authenticated attacker load a crafted .NET assembly into a protected process and bypass Windows Defender Application Control. CVE-2026-92707 is a Moderate denial of service flaw in MessagePack-CSharp, which Microsoft describes as an uncontrolled memory allocation issue in .NET.

Why Email Users Should Care

Count the bugs in this release whose Microsoft FAQ names email or the Reading Pane: the exploited Shell flaw, five Critical Outlook bugs, the Outlook heap memory disclosure, the Exchange Critical and six Word bugs with the Preview Pane as a vector. That is 14. The inbox is still the front door, and Microsoft's own risk cohorts post frames the Office group around one question: "Which users, applications, and workstations process untrusted documents or mail?"

The Outlook bugs affect the Outlook that ships with Microsoft 365 Apps and Office LTSC 2021 and 2024, on Windows and on Mac, according to the affected products list. The Shell bug is different because it lives in Windows, not in Outlook. Microsoft's FAQ does not name a mail client; it only requires that a crafted file reach you by email or instant message and that you act on it. That leaves webmail users, Gmail included, inside the scenario Microsoft describes.

Expect phishing to lean on this release, too. A record patch month makes "urgent security update" lures more believable, and none of the fixes above arrive by email. They come through Windows Update and Office's own updater.

What Should You Do Now?

Patch Windows first, then Office, then Exchange. In order:

1. Install the October Windows update. It carries the only exploited bug, CVE-2026-96951. Tyler Reguly of Fortra told Krebs that teams should patch the Microsoft bugs on CISA's KEV list first; by our count of the CISA feed, this one makes 27 Microsoft CVE-2026 entries.
2. Update Office and Microsoft 365 Apps. The Outlook and Word Reading Pane bugs are fixed there, not in Windows. Microsoft lists no workaround for the five Outlook Criticals and does not tell users to turn off the Reading Pane, so the update is the fix. Office LTSC for Mac users should watch the advisories for the delayed builds.
3. Patch on premises Exchange and plan the move to Exchange Server Subscription Edition if you still run 2016 or 2019.
4. Check your Windows 11 version. Microsoft's lifecycle page shows 24H2 Home and Pro support ended with this release; 25H2 is supported until October 2027. Windows 10 consumers enrolled in extended updates get fixes until October 2027, Krebs notes.
5. Treat unexpected attachments as hostile, especially ones that ask you to unblock content. Outlook already blocks some file types such as .exe, and on Exchange accounts your administrator controls that list.

What Happens Next?

Three things to watch. Windows 11 23H2 Enterprise, Education and IoT Enterprise stop getting security updates in November, according to BleepingComputer. Exchange 2016 and 2019 lose their last paid updates when October ends. And the Mac LTSC Outlook fixes are still pending. Beyond that, Microsoft has already warned that each release will carry a higher volume of updates as AI finds more bugs.