October 2026 Patch Tuesday: 1408 fixes, 78 Critical, 1 exploited

Automatic post. Built by KEH-TECH from the Patch Tuesday hub, which reads Microsoft’s Security Update Guide and CISA’s Known Exploited Vulnerabilities catalog, and published without editing. The figures are the source’s own; follow the links for the full detail.

October 2026 Patch Tuesday: Microsoft fixed 1408 vulnerabilities, 78 of them Critical. 1 was already being exploited. 1 was publicly disclosed before the fix.

Patch these first

Anything already exploited, publicly disclosed or on CISA’s list:

• CVE-2026-108398 .NET Framework Security Feature Bypass Vulnerability, .NET Framework (publicly disclosed)
• CVE-2026-96951 Windows Shell Security Feature Bypass Vulnerability, Windows Shell (exploited, on CISA KEV, federal deadline 16 October 2026)

Highest-scoring Critical fixes to install

• CVE-2026-100202 Windows Message Queuing Queue Manager Remote Code Execution Vulnerability (CVSS 9.8)
• CVE-2026-100219 Microsoft QUIC Remote Code Execution Vulnerability (CVSS 9.8)
• CVE-2026-105016 Microsoft QUIC Remote Code Execution Vulnerability (CVSS 9.8)
• CVE-2026-70147 Microsoft PostScript Printer Driver Remote Code Execution Vulnerability (CVSS 9.8)
• CVE-2026-70153 Microsoft PostScript Printer Driver Remote Code Execution Vulnerability (CVSS 9.8)

Exploited elsewhere: CISA’s list so far in October

Not only Microsoft. Since 1 October 2026, CISA has added 11 entries to its Known Exploited Vulnerabilities catalog, 10 from other vendors. Newest first:

• CVE-2026-104935 Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability. Added 13 Oct.
• CVE-2026-96951 Microsoft Windows Command Injection Vulnerability. Added 13 Oct.
• CVE-2015-3306 ProFTPD Improper Access Control Vulnerability. Added 8 Oct.
• CVE-2015-5477 ISC BIND Data Processing Errors Vulnerability. Added 8 Oct.
• CVE-2016-3081 Apache Struts Command Injection Vulnerability. Added 8 Oct.
• CVE-2021-3199 ONLYOFFICE Docs Server Path Traversal Vulnerability. Added 8 Oct.
• CVE-2023-22894 Strapi Cleartext Storage of Sensitive Information Vulnerability. Added 8 Oct.
• CVE-2026-88779 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability. Added 4 Oct.
• CVE-2026-102489 Zammad GmbH Zammad Session Fixation Vulnerability. Added 2 Oct.
• CVE-2026-102490 Zammad GmbH Zammad Improper Privilege Management Vulnerability. Added 2 Oct.
• CVE-2026-104286 Fortinet FortiMail Path Traversal Vulnerability. Added 1 Oct.

What kind of fixes

Elevation of Privilege: 673 · Remote Code Execution: 315 · Information Disclosure: 252 · Denial of Service: 72

Rolling it out? Every fix, with filters, is on the October 2026 Patch Tuesday page. Tell everyone what broke (or did not) in The Patch Panel.