Microsoft Windows 11
Microsoft has released its October 2026 Patch Tuesday security rollout, delivering fixes for a record-breaking 1,411 vulnerabilities, including one actively exploited zero-day and two publicly disclosed zero-day flaws. “Today, October 13, 2026, Windows 11, version 24H2 Home and Pro, and Windows 10 Enterprise LTSB 2016 have reached end of updates. The October 2026 monthly security update is the last update available for these editions,” Microsoft stated.
Microsoft did not disclose who reported the vulnerability.
The monthly release addresses 70 “Critical” vulnerabilities, consisting of 57 Remote Code Execution flaws, 11 Elevation of Privilege issues and 2 spoofing bugs. In one case, attackers actively exploited this flaw to evade Windows’ “Mark of the Web” security mechanism. The huge volume of fixes comes as Microsoft increasingly leans on artificial intelligence (AI) platforms to discover and remediate security bugs across its software ecosystem. Across the release, elevation of privilege and remote execution bugs made up the vast majority of the patched flaws: Microsoft defines a zero-day vulnerability as a flaw that has been publicly disclosed or actively exploited before an official patch exists. The October update resolves three such weaknesses. The second local security bypass flaw was discovered by James Forshaw of Google Project Zero, and allows authenticated attackers to subvert Windows Defender Application Control (WDAC) and launch unauthorized applications. Thirdly, the flaw is caused by improperly controlled sequential memory allocation within .NET, and enables unauthorised attackers to trigger a denial-of-service condition over a network.
Security Feature Bypass: 40 vulnerabilities Microsoft warned that “improper neutralization of special elements used in a command (‘command injection’) in Windows Shell allows an unauthorized attacker to bypass a security feature over a network. ”