thankyouforpatching.com11 openbuilt 2026-10-25 00:21 UTC

~Microsoft

Patch now

October 2026 Patch Tuesday: 1,413 fixes, one exploited zero-day, and an Exchange hangover

Open

Vendor
Microsoft
Products
Windows 10, Windows 11, Windows Server 2016-2025, Exchange Server, and Classic Outlook
Date
Status
Open

Call: Patch now. The Windows cumulative updates fix CVE-2026-96951, a Windows Shell Mark-of-the-Web bypass that is being exploited. CISA added it to KEV with a due date of October 16. Install it. Then work through the side effects below by role instead of holding the whole estate.

The numbers

Microsoft fixed 1,413 CVEs this month (SecurityWeek, CyberScoop, Malwarebytes). BleepingComputer counts 1,411 because it only includes the Patch Tuesday releases themselves. Either way it’s a record. CyberScoop says it beats Microsoft’s previous full-year record of 1,261, set in 2020, and SecurityWeek says it’s more than all of 2025 combined. One month. BleepingComputer counts 70 critical.

  • Exploited: CVE-2026-96951 (Windows Shell MotW bypass).
  • Publicly disclosed: CVE-2026-108398 (.NET Framework WDAC bypass) and CVE-2026-92707 (MessagePack-CSharp DoS).
  • KBs: KB5127648 (Win11 24H2/25H2/26H2), KB5126653 (Win11 23H2), KB5126657 (Win10 21H2/22H2), KB5126646 (WS2025), KB5126655 (WS2022), KB5126651 (WS2019), KB5126868 (WS2016).

What breaks

On-prem Exchange (Deploy with care, confirmed by Microsoft). The October Windows Server updates (KB5126651, KB5126868, KB5126655, KB5126646) cap Endpoint Mapper lookups. On busy Exchange 2016/2019/SE servers, the default 512 RPC contexts fill in about a day. Then OWA throws MapiExceptionMdbOffline, queues fill with 432 4.3.2, and mail sits in Outbox. Microsoft says don’t uninstall. Set EpmapSavedContextCap to 65536 under HKLM\SOFTWARE\Microsoft\Rpc and restart; you can set it before you install. No fix is imminent. (Exchange team blog, r/sysadmin)

PEAP-MSCHAPv2 SSO (Deploy with care). NTLMv1 SSO blocking is now enforced by default on Win11 24H2+ and WS2025 when Credential Guard is off. Only “use my Windows logon” pass-through breaks; typed credentials and machine-certificate auth are fine. About 4 independent megathread commenters plus two threads hit it. Microsoft calls it planned. Use BlockNtlmv1SSO=0 as a dated exception (event 4024 = audit, 4025 = block), and plan EAP-TLS. (KB5127648, MS Q&A)

Boot failures (Deploy with care, reported, not confirmed). There are 6 independent first-hand reports of KB5127648 failing at the finalizing reboot: 0xc000000d, winload.efi errors, or BitLocker recovery. They’re mostly Dell, plus Dynabook Tecra A60-M. One fleet of about 5,000 lost “a few.” Pilot by model and update firmware first. The workaround is DISM /revertpendingactions plus bcdboot from WinRE. (r/sysadmin, Tech Community)

Smaller items:

  • Smart App Control can’t be turned back on after KB5127648. There’s a registry workaround.
  • Non-admin RDP fails with 0xC000000D on hosts with Administrator protection.
  • Always On VPN automatic protocol selection is still broken. Microsoft marked it resolved, then reverted that on Oct 19.
  • Born reports install errors 0x800f0845/0x80070306/0x800f0989, and more than 70 Xbox Live 0x87DD0005 complaints. Neither is confirmed.

The rumor check

We were told October “broke security software and Classic Outlook.” Here, “security software” means physical security: Lenel, Genetec and similar. Here’s what the sources support:

  • Record count: true. See above.
  • Physical security software: not confirmed for October as such. There is one real thread, and it’s older.
    • About 5 independent Reddit reports say older LenelS2 OnGuard (8.1 and earlier) loses its Login Driver/database connection after the August 11, 2026 cumulative updates, and every CU since, October included.
    • LenelS2 hasn’t posted anything official. One second-hand TSG statement says only 8.0 and below are affected, but two posters say 8.1 is too.
    • Call: hold those hosts only, isolate them (the CU fixes an exploited zero-day), and upgrade OnGuard.
    • I found nothing for Genetec, Milestone, C•CURE 9000, Avigilon or Pro-Watch.
  • Classic Outlook: not as stated. Classic Outlook has open Microsoft-documented problems: stale shared-mailbox search, a shared-calendar crash, and Kaspersky crashes. None of them come from the Windows update. If your Outlook clients are stuck in Outbox, look at your Exchange servers first.

Housekeeping

  • AskWoody is at MS-DEFCON 2 (defer until at least Oct 27).
  • Windows Server 2022 left mainstream support on Oct 13.
  • Canadian time zone updates land before Nov 1.

Full tracker: Patch Watch.

Sources