Microsoft released an October Windows update that patches over 1,400 security vulnerabilities, including two zero-day flaws, according to patch management provider Action1.
One zero-day, CVE-2026-96951, has already been exploited in the wild. It affects Windows Shell and allows remote attackers to bypass security protections by convincing users to open specially crafted files or interact with malicious content. Action1 warned that successful exploitation "could weaken Windows security protections and increase the risk of malicious content reaching users without the expected security warnings."
The second zero-day, CVE-2026-108398, was publicly disclosed before the patch rolled out. It exploits a flaw in Microsoft's .NET Framework to bypass security measures.
The October update also includes 80 critical vulnerabilities across all supported Windows 11 versions (26H2, 26H1, 25H2, 24H2, and 23H2 Enterprise and Education editions). Windows 10 systems enrolled in Microsoft's Extended Security Updates program receive the patches as well.
Microsoft attributes the large patch volume to its internal AI scanning tool, codenamed MDASH. The system identifies real Windows vulnerabilities, reduces false positives, and accelerates delivery of findings to engineers. October's patch count surpasses September's approximately 1,000 fixed vulnerabilities.
Beyond security fixes, the update resolves File Explorer glitches, including more reliable preview pane rendering for downloaded files and cloud-based file thumbnails in the Details pane. File Explorer now retains the expanded or collapsed state of sections. The update also improves the accuracy and stability of connected Bluetooth devices.
October marks the first official update for Windows 11 26H2 and the last for Windows 11 24H2 Home and Pro editions. Windows 11 24H2 reaches end of support this month after 24 months. Windows 11 23H2 Enterprise and Education editions reach end of support on November 10. Users on unsupported versions will no longer receive security updates or bug fixes after these dates.
The update adds a new setting allowing users to remap the Copilot key to function as the right Ctrl key or right-click context menu instead of triggering Microsoft's AI assistant.