senn-techsenn-tech
Security
Security2026-10-13· By Franz Senn

Patch Tuesday October 2026: 1,411 fixes, three zero-days and KB5127648

On 13 October 2026 Microsoft fixed 1,411 security flaws, by the count of BleepingComputer. That is a record and excludes 348 flaws fixed earlier in the month. Three are zero-days, and one is being exploited. Deskmodder covers the matching Windows 11 update, KB5127648.

Microsoft wordmark
In its list of critical flaws BleepingComputer also names components outside Windows itself, such as Linux kernel, Apache and Go entries. (Quelle: File via Wikimedia Commons)

The numbers

Microsoft rates 70 of the 1,411 flaws as critical. 57 of those allow remote code execution, 11 raise privileges and 2 are spoofing bugs. BleepingComputer gives the breakdown by category as approximate.

Flaws by category (approximate)Elevation of privilege677Remote code execution317Information disclosure254Denial of service73Security feature bypass40Spoofing280700
The categories add up to 1,389, not 1,411. BleepingComputer gives the per-category counts only as approximate. (Quelle: BleepingComputer, 13 October 2026)

The three zero-days

CVE-2026-96951 is a security feature bypass in the Windows Shell and is actively exploited. It bypasses Mark of the Web, the tag that makes Windows treat files from the internet with warnings. Microsoft describes it as command injection in the Shell and shares neither exploitation details nor the reporter.

CVE-2026-108398 affects the .NET Framework and can bypass Windows Defender Application Control so that unauthorized code runs. Publicly disclosed and rated important, it was found by James Forshaw of Google Project Zero. Per BleepingComputer the attack needs no user interaction. CVE-2026-92707 is a denial of service in MessagePack-CSharp, publicly disclosed and rated moderate.

Among the critical entries BleepingComputer lists are CVE-2026-70229 (Active Directory Domain Services, remote code execution), CVE-2026-96222 and CVE-2026-108131 (AD FS, spoofing) and many Linux kernel entries. The list in the report is truncated, so it is incomplete.

KB5127648 for Windows 11

The update appeared on 13 October and takes Windows 11 26H2 to build 26300.9711 and 25H2 to 26200.9711. It contains the changes of the optional September update KB5124010. Deskmodder names these fixes, among others:

  • Windows Explorer: startup failures and black screens in AVD and FSLogix multi-user environments
  • Always On VPN: connections stuck at "connecting" after KB5124008
  • Storage Spaces Direct: multi-tier virtual disks that failed to come online after certain security updates
  • Printing: failures with RAW and "Generic Text Only" drivers after the August update
  • Windows Hello: fingerprint sign-in after a cold boot

The Manitoba time zone (UTC-05:00) is added for the clock change on 1 November 2026. The Secure Boot certificate rollout continues, and monitoring for ReFS on removable storage is on by default, with enforcement off.

Version change and end of support

It is the first security update for 26H2 and the last for 24H2 in the Home and Pro consumer editions. Moving from 24H2 or 25H2 to 26H2 uses the enablement package KB5121794.

Path to 26H224H2 / 25H2last patch for 24H2 Home/ProKB5121794enablement package26H2build 26300KB5127648build 26300.9711
Deskmodder gives no end-of-support date for 25H2 or 26H2. (Quelle: Deskmodder, 13 October 2026)

Known issues

Deskmodder lists two confirmed problems: USB audio devices produce no sound or report error code 10, and non-admin users cannot make Remote Desktop connections (error 0xC000000D). For the latter, admins can, per Deskmodder, temporarily disable Administrator Protection by resetting the policy “User Account Control: Type of Admin Approval Mode” in Intune or Group Policy. Anyone using Remote Desktop with standard accounts should test the update in a small group first.

The reader comments at Deskmodder add unconfirmed reports: unexpected restarts, Windows Update stalling at 99 percent, a failed .NET update KB5127694, Sandbox crashes. They are single cases and no substitute for a test.

What to do now

The actively exploited CVE-2026-96951 is the reason not to let the update sit: it undermines the warning on files from the web. Our suggestion: a small pilot group first, especially machines with Remote Desktop, USB headsets and printers, then everyone else. Systems on 24H2 Home or Pro receive no more security updates after this one and need the move to 25H2 or 26H2.

Further reading

Questions?
Which zero-days are included?+

CVE-2026-96951, a security feature bypass in the Windows Shell (it bypasses Mark of the Web), is actively exploited. CVE-2026-108398 (.NET Framework, bypass of Windows Defender Application Control) and CVE-2026-92707 (MessagePack-CSharp, denial of service) are publicly disclosed but not reported as exploited.

Which build belongs to KB5127648?+

Build 26300.9711 for Windows 11 26H2 and 26200.9711 for 25H2. KB5127648 is the first security update for 26H2 and the last for 24H2 in the Home and Pro consumer editions. Moving from 24H2 or 25H2 to 26H2 goes through the enablement package KB5121794.

What known issues exist?+

Deskmodder lists two: USB audio devices with no sound or error code 10, and non-admin users who cannot make Remote Desktop connections (error 0xC000000D). For the latter, admins can, per Deskmodder, temporarily disable Administrator Protection by resetting the policy “User Account Control: Type of Admin Approval Mode”.