Microsoft Fixes 80 Critical Flaws in October 2026 Patch Tuesday Updates

Microsoft has released the October 2026 Patch Tuesday Updates for all supported versions of Windows 11. This month, the company has addressed 1415 new CVEs in Windows, Office, SharePoint, Linux kernel, SQL Server and Dynamics, Azure and cloud services, and Exchange Server.

Microsoft has also announced that Windows 11 version 24H2 Home and Pro, and Windows 10 Enterprise LTSB 2016 have reached end of support this week. The company is urging customers to upgrade to the latest versions of Windows 11.

October 2026 Patch Tuesday updates fix 80 critical vulnerabilities

As pointed out by Zero Day Initiative, Microsoft has fixed 80 Critical vulnerabilities, two zero-day flaws, and the rest are rated “Important” in severity. Here’s a list of the most important vulnerabilities that were fixed this month:

• CVE-2026-96951: This is a high-severity Windows Shell command injection vulnerability that allows an unauthenticated attacker to bypass a Windows security feature over a network by exploiting how the shell handles specially crafted commands. It carries a CVSS score of 8.8, and Microsoft has confirmed that it has been actively exploited.
• CVE-2026-102866: This is a high-severity elevation of privilege vulnerability in Microsoft Office SharePoint caused by improper verification of cryptographic signatures. An unauthenticated attacker could exploit the flaw over a network to gain elevated privileges on affected Microsoft SharePoint Server Subscription Edition systems.
• CVE-2026-65674: This is a high-severity remote code execution (RCE) vulnerability in Microsoft SQL Server caused by the deserialization of untrusted data. An attacker with low privileges could exploit the flaw over a network to execute arbitrary code on an affected SQL Server instance.
• CVE-2026-105016: This is a critical remote code execution (RCE) vulnerability in Microsoft QUIC caused by a heap-based buffer overflow. An unauthenticated attacker can send a specially crafted IPv6 QUIC packet over the network to trigger arbitrary code execution without requiring user interaction.

You can find the full list of CVEs that Microsoft fixed in October 2026 below:

Quality and experience updates

Microsoft has released the KB5127648 update for Windows 11 versions 24H2, 25H2, and 26H2. This release continues the deployment of updated Secure Boot certificates using the latest high-confidence targeting data to identify eligible devices that are ready to automatically receive the new certificates. Moreover, this update adds auditing and optional policy controls for ReFS volumes on externally attached storage devices. The KB5127648 patch also fixes an issue where printing could fail in some apps and on devices using RAW or Generic Text Only printer drivers after installing the August 2026 security update.

For Windows 11 version 26H1, Microsoft has rolled out the KB5127646 update that includes additional high-confidence device targeting data, which increases coverage of devices eligible to automatically receive new Secure Boot certificates. Moreover, this patch fixes an issue that affects tiered Storage Spaces Direct virtual disks.

Windows Update testing and best practices

Organizations looking to deploy this month’s patches should conduct thorough testing before deploying them widely on production systems. That said, applying the patches widely shouldn’t be delayed longer than necessary, as hackers start to work out how to weaponize newly reported vulnerabilities.

A best practice is to make sure you have backed up systems before applying updates. Every month, users experience issues with Windows updates that lead to systems not booting, application and hardware compatibility issues, or even data loss in extreme cases.

There are backup tools built into Windows and Windows Server that you can use to restore systems in the event a patch causes a problem. The backup features in Windows can be used to restore an entire system, or files and folders on a granular basis.