October 2026 Patch Tuesday: The Zero-Day, KB5127648 and Should You Update?

Last updated: October 14, 2026. By Veer. Facts checked against Microsoft’s KB5127648 release notes, Windows 11 release information, the Windows 11 26H2 release health page, CISA’s Known Exploited Vulnerabilities catalog, and reporting from BleepingComputer, the Zero Day Initiative, Krebs on Security and CrowdStrike.

If your PC asked to restart overnight, this is why. Microsoft’s October update is the biggest it has ever shipped, and one of the bugs in it is already being used in attacks. Here’s what the October 2026 Patch Tuesday fixes, which KB number your PC should get, what’s still broken, and how to install it.

What is in the October 2026 Patch Tuesday?

The October 2026 Patch Tuesday, released on October 13, 2026, fixes more than 1,400 vulnerabilities across Windows, Office, SharePoint, Exchange, SQL Server, .NET and Azure. It includes one actively exploited zero-day and two publicly disclosed ones. It is the largest monthly release Microsoft has shipped, beating September’s record of nearly 1,000 fixes.

Microsoft’s own update bundle is so large that trackers don’t agree on the total. BleepingComputer counts 1,411 flaws released on Patch Tuesday itself, and leaves out 348 that Microsoft fixed earlier in October. The Zero Day Initiative counts 1,415 new Microsoft CVEs and notes this single month is “a greater volume than any previous YEAR from Microsoft.”

The exact number doesn’t change what you need to do. A lot of those fixes are for cloud services Microsoft patches on its own servers, so home users and most businesses only need to install the normal Windows and Office updates.

Why so many? Microsoft credits AI tools for finding more bugs. “We’ve now crossed the 4,000 CVE mark with two months left to go,” Satnam Narang of Tenable told Krebs on Security. The previous full-year record was 1,261 in 2020.

Which zero-day is being exploited (CVE-2026-96951)?

CVE-2026-96951 is a Windows Shell security feature bypass, rated Important with a CVSS score of 8.8, that Microsoft says attackers are already exploiting. It lets a booby-trapped file get around Mark of the Web, the tag Windows puts on downloads so SmartScreen and Office Protected View can warn you before you open them. CISA added it to its exploited list on October 13.

Mark of the Web is the reason Windows shows “Windows protected your PC” or opens email attachments in read-only Protected View. Microsoft describes the flaw as “improper neutralization of special elements used in a command (‘command injection’) in Windows Shell,” which “allows an unauthorized attacker to bypass a security feature over a network,” per BleepingComputer.

The attack still needs you to open something. CrowdStrike explains that an attacker sends “a specially crafted file via email, instant message, or web download, and a user must open or click the malicious content.” Once Mark of the Web is stripped, SmartScreen, Office Protected View and Application Guard “no longer apply.” That makes it a good fit for phishing.

Microsoft hasn’t said who is exploiting CVE-2026-96951 or how widely. CISA lists it as added on October 13, 2026 with a federal due date of October 16, 2026. CISA’s deadline only binds US federal agencies, but it’s a good guide for everyone else.

According to Krebs on Security, the bug affects Windows 10 and 11 as well as some Windows Server versions. AdminSignal says the fix ships in KB5127648, KB5126653 and KB5127646 plus the matching Windows 10 and Server packages.

What are the other zero-days?

Two other flaws were made public before Microsoft fixed them, but neither is known to be exploited: CVE-2026-108398 in the .NET Framework and CVE-2026-92707 in MessagePack-CSharp. Some outlets also called a SharePoint bug a zero-day. The Zero Day Initiative’s table lists that one as neither public nor exploited.

Severity and CVSS scores from the Zero Day Initiative’s October 2026 table.

The .NET bug, CVE-2026-108398, was found by James Forshaw of Google Project Zero. Microsoft says an attacker who already has an account “could place a specially crafted .NET assembly on an affected system and register it for loading by a protected process,” which “could bypass Windows Defender Application Control restrictions,” BleepingComputer reports. AdminSignal notes this fix comes in the separate .NET Framework update, not always inside the Windows cumulative update.

The SharePoint flaw, CVE-2026-102866, is the one admins should look at after the Windows zero-day. ZDI says it is “the only Critical-rated SharePoint CVE” this month and “the only one an unauthenticated attacker can exploit,” but the attacker first needs a valid proof token for the user they’re targeting.

Which KB number should my PC get?

Windows 11 versions 26H2, 25H2 and 24H2 get KB5127648. Windows 11 23H2 gets KB5126653, Windows 11 26H1 gets KB5127646, and Windows 10 PCs enrolled in Extended Security Updates get KB5126657. All of them were released on October 13, 2026. Check your build number after the restart to make sure it installed.

Builds and dates from Microsoft’s Windows 11 release information page and the KB5126657 release notes.

KB5127648 also bundles servicing stack update KB5127647 and carries every fix from September’s updates, including the optional September 22 preview, KB5124010. You don’t need to install anything first if you use Windows Update.

What does KB5127648 fix besides security?

KB5127648 fixes two problems that had been on Microsoft’s known-issues list: apps that use AC-3 (Dolby Digital) audio crashing, and Explorer black screens on Azure Virtual Desktop and FSLogix. It also fixes Always On VPN connections getting stuck, printing failures with RAW or Generic Text Only drivers, game mouse stutter and fingerprint sign-in after a cold boot.

Here is the full list from Microsoft’s KB5127648 notes:

• Audio (known issue, fixed): “fixes an issue that affects AC-3 audio playback in some applications.” This was the Dolby Digital crash that started with the September 22 preview.
• Windows Explorer (known issue, fixed): on Azure Virtual Desktop and FSLogix setups, Explorer.exe “might fail to start or repeatedly crash, causing a black screen.”
• Always On VPN: connections could get stuck on “Connecting” after installing KB5124008, sometimes with “The specified port is already in use.”
• Printing: printing could fail with RAW or Generic Text Only printer drivers after the August 2026 update.
• Gaming: “an issue that could cause mouse input to stutter in some games.”
• Windows Hello: fingerprint sign-in “might not work after a cold boot on some devices.”
• Storage Spaces Direct: some tiered virtual disks could fail to come online.
• Time zone: adds the new (UTC-05:00) Manitoba time zone ahead of the November 1, 2026 change.
• ReFS: starts auditing ReFS drives on external storage (KB5130741). AdminSignal says blocking becomes the default with the January 2027 update.
• Secure Boot: keeps rolling out the newer Secure Boot certificates. Microsoft says devices that don’t have them yet “can continue to start and receive standard Windows updates.”

BleepingComputer’s KB5127648 rundown also lists visible features such as Emoji 17.0, a Copilot key remap option, a Tips widget and new touchpad scrolling gestures. Microsoft’s October KB page doesn’t list those features itself, so treat them as BleepingComputer’s report.

What known issues does the October update have?

Microsoft lists one open known issue in KB5127648: some USB Audio Class 1.0 devices still show error Code 10, have no sound, or have dead volume controls. A second issue opened on October 13 affects Remote Desktop with Administrator protection turned on. Most home users won’t run into either one.

The USB audio bug started with the September 8 update. Microsoft’s September 14 out-of-band update fixed the 8-channel and 3D audio symptoms, but Microsoft says it “is working to address the other symptoms.” The same issue is listed for the Windows 10 update, KB5126657. Some users have got sound back by switching the device to 2-channel mode.

The Remote Desktop bug is listed as Mitigated on the 26H2 release health page. Non-admin users connecting to a PC that has Administrator protection turned on might get error 0xC000000D, “The token that was passed to the function is invalid.” It started with KB5124010 and also affects later updates. Microsoft’s security baselines turn Administrator protection on, so businesses that use those baselines are the ones most likely to hit it. For now, Microsoft’s workaround is to turn Administrator protection off on the affected hosts.

If you put off Windows 11 26H2 because of the Dolby Digital crash, that reason is now gone. Our Windows 11 26H2 known issues guide has been updated with the new status.

Should you install the October 2026 update?

Yes. Install the October 2026 update this week, on home and work PCs alike. The Windows Shell zero-day is already being exploited, it affects Windows 10 and 11, and Microsoft lists only one carried-over known issue for home PCs. The only reason to hold off briefly is a USB Audio Class 1.0 device you rely on every day.

A quick way to decide:

• Home user on Windows 11 25H2 or 26H2: install now and restart.
• Home user on Windows 11 24H2 Home or Pro: install now, then plan the move to 25H2 or 26H2. This is your last update.
• Windows 10 with ESU: install KB5126657. Without ESU you won’t get this fix at all.
• Business IT: Fortra’s Tyler Reguly suggests focusing first on bugs in CISA’s exploited list. AdminSignal suggests getting the October update onto internet-facing and admin workstations “within days rather than the normal broad-ring window.”
• USB Audio Class 1.0 user: check Device Manager after updating, and switch to 2-channel audio if multichannel sound fails.

There’s no sign October’s update causes more problems than usual. BleepingComputer reports that Microsoft “is not aware of any new issues” with KB5127648, apart from the USB audio problem carried over from September.

How do you install the October 2026 Patch Tuesday update?

Open Settings > Windows Update, click Check for updates, let KB5127648 (or your version’s KB) download, then restart. Microsoft says the update “downloads and installs automatically” from Windows Update, so many PCs will already have it waiting. Then confirm the build number.

1. Save your work and plug in your laptop.
2. Open Start > Settings > Windows Update and click Check for updates.
3. Wait for “2026-10 Cumulative Update” with your KB number to download and install.
4. Click Restart now. KB5127648 needs a restart. Microsoft lists it as a “Baseline (Restart)” month even for hotpatch devices.
5. Press Windows + R, type winver and press Enter. Check the build against the table above, for example 26200.9711 on 25H2.
6. Update Office and apps as well. Microsoft 365 apps usually update themselves; to force it, open any Office app and go to File > Account > Update Options > Update Now. Microsoft Store apps such as HEVC Video Extensions, which has a Critical fix (CVE-2026-108400) this month, update through the Microsoft Store.

If Windows Update fails, you can download the standalone package from the Microsoft Update Catalog. Microsoft says the package needs a checkpoint update (KB5043080) installed first, and DISM will find it automatically if both files are in the same folder.

For admins, AdminSignal gives a quick PowerShell check: Get-HotFix | Where-Object HotFixID -in 'KB5127648','KB5126653','KB5127646'. Check the build number rather than just the policy assignment, because a device isn’t protected until it has restarted onto the new build.

Is this the last update for Windows 11 24H2 and Windows 10?

For Windows 11 24H2 Home and Pro, yes. October 2026 is the final update. “The October 2026 monthly security update is the last update available for these editions,” Microsoft’s KB5127648 page says. Windows 10 is different: PCs in Extended Security Updates keep getting fixes until October 2027.

Windows 11 24H2 Enterprise and Education stay supported until October 12, 2027. Home and Pro PCs need to move to 25H2 or 26H2 to get November’s fixes. The upgrade is a small enablement package with one restart. Our Windows 11 24H2 end of support guide walks through it.

Windows 10 Enterprise LTSB 2016 also reached end of updates on October 13, according to BleepingComputer. Windows 11 23H2 Enterprise and Education get one more update, on November 10, 2026.

For Windows 10 22H2, the October update only reaches PCs enrolled in ESU. Krebs on Security notes that Microsoft extended that support “until October 2027.” KB5126657 also fixes the File History “Reconnect your drive” bug. If your Windows 10 PC didn’t get KB5126657, it isn’t protected against CVE-2026-96951. Our Windows 10 ESU guide explains how to enroll, and the Windows end of support calendar lists every upcoming deadline.

What else should you update this week?

Other vendors shipped urgent fixes alongside Microsoft. Ivanti Connect Secure (CVE-2026-104935) joined CISA’s exploited list on October 13 with the same October 16 deadline. BleepingComputer also lists exploited zero-days fixed this month in Citrix NetScaler and Fortinet FortiMail, plus Adobe updates for ColdFusion, Commerce and Photoshop.

For home users, the short list is Windows, Office, your browser and your phone. CISA’s deadline for the exploited Apple CoreGraphics flaw (CVE-2026-86950) was also October 13. If your iPhone is still on iOS 26, see our iOS 26.7.1 security update guide.

Microsoft also tried something new this month. It grouped the October flaws into 15 “risk cohorts,” such as 136 bugs in Windows filesystems, storage and backup, to help admins plan. Microsoft says the cohorts “are not official Microsoft vulnerability categories, do not change Microsoft update guidance, and do not replace the assessment of individual CVEs,” as quoted by ZDI.

Timeline: October 2026 Windows updates and deadlines

The dates that matter are October 13 (release), October 16 (CISA deadline for the zero-day) and November 10, 2026 (next Patch Tuesday). Here’s the full timeline.

FAQ

When was the October 2026 Patch Tuesday?

Microsoft released the October 2026 Patch Tuesday updates on Tuesday, October 13, 2026. The next Patch Tuesday is November 10, 2026.

How many vulnerabilities did the October 2026 Patch Tuesday fix?

More than 1,400, a record. BleepingComputer counts 1,411, CrowdStrike 1,413 and the Zero Day Initiative 1,415. The totals differ because trackers count cloud-only and third-party CVEs differently.

Is there a zero-day in the October 2026 Patch Tuesday?

Yes. CVE-2026-96951, a Windows Shell security feature bypass that gets around Mark of the Web warnings, is being exploited. CISA added it to its Known Exploited Vulnerabilities catalog on October 13, 2026, with a federal deadline of October 16.

What is KB5127648?

KB5127648 is the October 13, 2026 cumulative security update for Windows 11 versions 26H2, 25H2 and 24H2. It moves them to builds 26300.9711, 26200.9711 and 26100.9711 and fixes the AC-3 audio crash and the Azure Virtual Desktop black screen.

Is KB5127648 safe to install?

Microsoft lists one open known issue: some USB Audio Class 1.0 devices may show Code 10 or play no sound, which started with September’s update. For most PCs, the exploited zero-day is a much bigger risk than that bug, so install it.

Does Windows 10 get the October 2026 update?

Only if the PC is enrolled in Extended Security Updates or runs Windows 10 Enterprise LTSC 2021. Those PCs get KB5126657 (build 19045.7807 on 22H2). Other Windows 10 PCs get no security fixes.

Sources

• Microsoft Support, “October 13, 2026—KB5127648 (OS Builds 26300.9711, 26200.9711 and 26100.9711)”: support.microsoft.com
• Microsoft Support, “October 13, 2026—KB5126657” (Windows 10 ESU): support.microsoft.com
• Microsoft Support, “October 13, 2026—KB5126653 (OS Build 22621.7652)”: support.microsoft.com
• Microsoft Learn, Windows 11 release information (updated October 13, 2026): learn.microsoft.com
• Microsoft Learn, Windows 11 version 26H2 known issues and notifications (updated October 13, 2026): learn.microsoft.com
• Microsoft Update Catalog, KB5127648: catalog.update.microsoft.com
• CISA, Known Exploited Vulnerabilities Catalog (CVE-2026-96951 and CVE-2026-104935 added October 13, 2026): cisa.gov
• BleepingComputer, “Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days,” October 13, 2026: bleepingcomputer.com
• BleepingComputer, “Windows 11 KB5127648 & KB5126653 cumulative updates released,” October 13, 2026: bleepingcomputer.com
• BleepingComputer, “Microsoft releases Windows 10 KB5126657 extended security update,” October 13, 2026: bleepingcomputer.com
• Zero Day Initiative, “The October 2026 Security Update Review,” October 13, 2026: zerodayinitiative.com
• Krebs on Security, “Microsoft Patches More Than 1,400 Security Flaws,” October 13, 2026: krebsonsecurity.com
• CrowdStrike, “October 2026 Patch Tuesday: Updates and Analysis”: crowdstrike.com
• AdminSignal, “October 2026 Patch Tuesday Admin Guide”: adminsignal.com