{"id":36885,"date":"2026-10-15T02:23:53","date_gmt":"2026-10-14T15:23:53","guid":{"rendered":"https:\/\/www.kaspersky.com.au\/blog\/2026-october-patch-tuesday\/36885\/"},"modified":"2026-10-15T02:23:53","modified_gmt":"2026-10-14T15:23:53","slug":"2026-october-patch-tuesday","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com.au\/blog\/2026-october-patch-tuesday\/36885\/","title":{"rendered":"Patches thick and fast: October bulletins from Microsoft and others"},"content":{"rendered":"

Microsoft\u2019s October Patch Tuesday update<\/a> stands out for two reasons. First, the total number of patches has reached four digits for the first time. Second, to help companies better understand the details of the vulnerabilities, Microsoft has decided to group them into risk cohorts<\/a>. A cohort brings together vulnerabilities that are exploited under the same conditions and affect the same systems. They replace neither the severity rating, nor the individual bulletins for each CVE. While they\u2019re unlikely to be suitable for comprehensive patch prioritization<\/a>, they will help quickly assess which part of an infrastructure is currently most at risk.<\/p>\n

Statistics corner<\/h2>\n

Of the 1,414 vulnerabilities addressed in the October Patch Tuesday release, 1,102 directly affect the Windows operating system, 134 \u2014 Microsoft Office, 36 \u2014 SharePoint Server, 22 \u2014 SQL Server, and seven \u2014 Exchange Server. The vast majority \u2014 677 \u2014 lead to privilege escalation, 317 to remote code execution, 40 to security bypass, and 73 to denial of service (DoS).<\/p>\n

There are 86 critical vulnerabilities on the list, of which 68 lead to RCE, 14 to privilege escalation, three to spoofing, and one to data leakage. In addition, two vulnerabilities were disclosed before being patched, and one is being exploited in real-world attacks.<\/p>\n

CVE-2026-96951 \u2014 vulnerability in Windows Shell<\/h2>\n

The only zero-day vulnerability patched in the October update that attackers are already exploiting in real-world attacks is CVE-2026-96951<\/a> in Windows Shell (CVSS severity score: 8.8). Details on how it\u2019s being exploited aren\u2019t yet known; however, according to Microsoft\u2019s description, it involves command injection that allows bypassing a security feature when accessing the system over a network. Microsoft credits experts at both Fujitsu and Anthropic for discovering the vulnerability, so it was likely found using neural networks.<\/p>\n

CVE-2026-108398 and CVE-2026-92707: vulnerabilities disclosed before patches were released<\/h2>\n

Information about these two vulnerabilities was made public before the October update was released. In theory, this could mean that attackers attempted to exploit them ahead of time. These are:<\/p>\n