Microsoft has released fixes for 1,413 vulnerabilities in its October 2026 scheduled update, the largest in its history, and has confirmed that attackers are already exploiting one of them. The release fixes more flaws than Microsoft patched in the whole of 2025, and takes the total for 2026 past 4,000. Of the October flaws, 1,102 affect Windows and 134 affect Office. NHS England's cyber alert for July recorded 622 fixes, so the latest figure is more than double that month's. The alert for the October release lists three zero-days, which are flaws that were exploited or publicly disclosed before a patch existed.

The flaw under attack is CVE-2026-96951, a security feature bypass in Windows Shell with a severity score of 8.8 out of 10. Microsoft describes it as improper neutralisation of special elements in a command, which allows an unauthorised attacker to bypass a security feature over a network. In practice it defeats Mark of the Web, the label Windows attaches to files downloaded from the internet so that users are warned before opening them. An attacker would use email or messages to persuade a target to open a malicious file. The US Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalogue on Tuesday and told federal agencies to fix it by 16 October. This is the third Windows Shell vulnerability to be actively exploited this year.Microsoft has shared no details of how attackers used it or who reported it.

Two other flaws were publicly disclosed before fixes were available. CVE-2026-108398 is a security feature bypass in the .NET Framework, also scored 8.8. The record describes an untrusted search path that lets an authorised attacker bypass a security feature locally. It requires local access and a low-privilege account, and Microsoft assesses exploitation as less likely. CVE-2026-92707 is a denial of service flaw in MessagePack-CSharp, a library used by developers, and carries a lower score of 5.3. Microsoft has not assessed it for exploitability. Counts differ between security firms. Tenable reports 1,407 vulnerabilities and two zero-days, one of them exploited. The NHS England alert follows Microsoft's own figures.

NHS England's National Cyber Security Operations Centre assesses that future exploitation of the three flaws is highly likely.In an October 14 alert rated medium severity, organizations are advised to review and apply Microsoft's October security updates immediately. The alert names Windows Server and the . NET Framework among the affected platforms and refers readers to Microsoft's update guide for the full list. Administrators in health and public service organisations will have to test and deploy a very large set of updates, and the Windows Shell fix has the strongest case for early deployment because exploitation is confirmed and the attack needs only a user to open a file.

Support for older software has also ended. As of 14 October, Microsoft no longer supports Windows 11 version 24H2 Home and Pro editions or Windows 10 Enterprise LTSB 2016. Devices running those versions will receive no further security updates, and the alert encourages organisations to move to a supported version. Extended security updates for Windows Server 2012 and 2012 R2 also ended this month. This isn't the first time we've seen this pattern this year. NHS England warned in July that SharePoint Server 2016 and 2019 had become unsupported on 14 July.

Every month brings fixes for flaws that unsupported systems will never receive, and the October release is the largest to date. The gap between the two widens each time a platform leaves support.