↓Skip to main content
  1. News/

October 2026 Windows Updates: What to Confirm With Your IT Person

·7 mins
Patch Tuesday Microsoft Windows Updates Small Business
Table of Contents
Microsoft’s October 2026 security release was a record-sized one, according to news reports, and one flaw in it was already being used by attackers before the fix existed. You do not need to read the technical details. You do need a short, written answer from your IT person or managed service provider (MSP) about whether your computers have the updates. This post explains what happened and what to ask.

What Patch Tuesday is #

Patch Tuesday is the day each month when Microsoft releases its security fixes for Windows, Office and its other products. It falls on the second Tuesday. This month that was October 13.

Most of the time it is routine. Your IT person or MSP installs the updates on a schedule, and nobody in the office notices beyond a restart. The work only becomes visible when a machine gets missed.

What was unusual this month #

Two things stand out: the size of the release, and one flaw that attackers were already using.

The size. Microsoft’s Security Update Guide, its public database of fixes, lists 1,420 entries dated October 13. News outlets that counted earlier in the week reported figures from 1,411 to 1,414. The flaw attackers were already using. Microsoft’s data marks exactly one entry as exploited: CVE-2026-96951, titled “Windows Shell Security Feature Bypass Vulnerability.” Microsoft rates it Important, with a CVSS score of 8.8 out of 10. CVSS is the standard severity scale for flaws.

In one sentence, Microsoft says the flaw could let an attacker evade Mark of the Web defenses. Mark of the Web is the label Windows puts on files that came from the internet, which triggers extra warnings when you open them. Microsoft’s FAQ says the attacker would have to persuade a user to click a link or open a file.

CISA, the US government’s cybersecurity agency, added the flaw to its Known Exploited Vulnerabilities catalog on October 13, under the title “Microsoft Windows Command Injection Vulnerability.” The label differs from Microsoft’s, but Microsoft’s description also uses the phrase “command injection.” BleepingComputer reports that no details have been shared about how it was exploited or who reported it. We cover the flaw in more depth in our closer look at that flaw.

Microsoft’s data also shows two publicly disclosed flaws that are not known to be exploited: a .NET Framework security feature bypass (Important, 8.8) and a MessagePack-CSharp denial of service (Moderate, 5.3). BleepingComputer counts all three as “zero-days,” meaning publicly known or exploited before a fix was available.

Why the big number is not a reason to panic #

Microsoft’s own data lists 78 entries rated Critical, its highest severity. That is worth taking seriously, and it is also a small share of the whole. Splashtop counts 1,329 Important entries and one Moderate among the 1,408 that carry a rating.

BleepingComputer links the record size to Microsoft’s continued use of artificial intelligence to find vulnerabilities. That is BleepingComputer’s reading. We did not find Microsoft saying it in the sources we read.

BleepingComputer also reports that Microsoft grouped related flaws into 15 “risk cohorts,” for example 136 Windows filesystem, storage and backup flaws. According to that article, Microsoft says the cohorts do not show which flaws are most dangerous, calls the approach experimental, and says it does not replace existing patching advice. In plain terms, even Microsoft is not asking you to rank this month’s flaws yourself. The usual advice applies: get the updates installed everywhere.

Four things to confirm with your IT person this week #

Send these as an email so the answers come back in writing.

  1. Are the October updates installed on every PC and server? Ask about all of them, not just the ones that are easy to reach, such as laptops that rarely come into the office.

  2. Who is responsible, and how would you know if a machine missed them? Ask for a short written report listing each machine and its update status. A verbal “yes, we’re on it” is not a record you can check later. If your IT person cannot produce a list of machines, that is useful to learn now.

  3. Is any PC on a Windows 11 edition that has just reached its last update? Microsoft’s KB5127648 page, dated October 13, states that “Windows 11, version 24H2 Home and Pro has reached end of updates,” and that the October 2026 security update is the last one for those editions. This applies to Home and Pro, not every 24H2 edition. Ask which edition and version each PC runs, and what the plan is. BleepingComputer adds that Windows 11 23H2 Enterprise, Education and IoT Enterprise stop receiving security updates in November 2026, per Microsoft’s earlier announcement. Splashtop advises identifying affected devices now, because they will need upgrades.

  4. Which machines are still waiting for a restart? Microsoft’s Windows Update FAQ says that to finish installing an update, a device needs to restart. Windows tries to restart when you are not using the device, and otherwise asks you to schedule one. So a PC that has downloaded the update but has sat unrestarted for days may not be finished. The KB5127648 page does not say whether this particular update needs a restart, so treat this as the general rule, not an October-specific one.

Splashtop also suggests patching CVE-2026-96951 first on all Windows endpoints within 72 hours, and keeping an accurate hardware and software inventory. That is one vendor’s advice. It fits the questions above, since you cannot patch a machine nobody has listed.

What not to do #

Do not panic about the headline number. According to BleepingComputer, Microsoft itself says its groupings do not rank danger.

Do not install updates yourself on business machines without telling your IT person. A change they do not know about makes their update report less accurate, and it can collide with their schedule. If you spot a PC showing an update prompt, tell them which one and let them decide.

How SOC-Lite can help #

At SOC-Lite, a named analyst reviews your alerts, calls you when one is real, works with your IT person or MSP on the fix, and keeps the evidence. A visibility check is free, it takes 20 minutes, and you talk to us by phone or at your office. Book a visibility check

Updates #

2026-10-22: Microsoft has changed its KB5127648 page since we published. Its entry count in the Security Update Guide is unchanged at 1,420.

  • On October 14 it added a known issue: non-admin users might be unable to make Remote Desktop connections to remote devices that have Administrator protection enabled, failing with error 0xC000000D. Microsoft says its security baselines turn Administrator protection on by default. It gives IT administrators a temporary workaround through policy and says it is working on a fix.
  • On October 15 it added a note that Windows now blocks NTLMv1-derived credentials for single sign-on by default when the BlockNtlmv1SSO setting is not configured. This applies only where Credential Guard is off, and Microsoft says it might affect Wi-Fi, Ethernet and VPN connections that use MS-CHAPv2-based authentication.
  • On October 20 it removed the information about a fix for a VPN connection issue that its page had previously described, saying that change will come in a future release.
  • It also lists a known issue where the option to turn on Smart App Control might be grayed out after the update. Devices where it is already on are not affected, and Microsoft says it is working on a resolution.

If staff report remote desktop, Wi-Fi or VPN trouble after the October update, tell your IT person which machine it was and when it started, and let them decide what to do.

2026-10-17: First published, based on the sources below as of this date.

Sources #