October Patch Tuesday Under Pressure
An exploited Windows weakness and a newly acknowledged Remote Desktop problem make October’s patch rollout a balancing act. The security change needs to move quickly, but a fleet-wide deployment also needs to preserve the remote access that administrators depend on to manage it.
Our 14 October count of Microsoft’s 13 October release cohort identified 1,410 CVEs: 70 Critical, one exploited and two publicly disclosed. The dated update below gives the later recount and preserves the difference. Those are separate signals, not interchangeable reasons to put every update at the front of the queue.
Update, 1 November 2026: later preview fixes are branch-specific
Microsoft’s October security-update notes had listed an Always On VPN correction before withdrawing that claim in their 20 October change logs. That withdrawal described the position at the time. Later preview updates now identify a correction for VPN profiles that automatically select or fall back between protocols, where connections could stay at Connecting, fail on the first attempt or report that a port was already in use.
KB5127936 applies to Windows 11 25H2 and 26H2, with builds 26200.9818 and 26300.9818 respectively. It lists the conditional Always On VPN fix, a fix for Smart App Control’s unavailable switch, and the Remote Desktop failure affecting non-admin users connecting to hosts with Administrator protection enabled. KB5127653, build 28000.3365 for 26H1, lists the VPN and Remote Desktop fixes. Its notes do not establish the Smart App Control correction for that branch. The preview-page headings say 28 October while their known-issue text refers to 27 October; that one-day discrepancy should not be hidden.
The VPN description is narrower than every possible remote-access failure. Microsoft’s architecture guidance distinguishes the user tunnel, which can use SSTP and IKEv2, from the device tunnel, which uses IKEv2 without that fallback. The separate NTLMv1 hardening change applies when Credential Guard is disabled and the BlockNtlmv1SSO registry value is not set. It blocks generation of NTLMv1-derived single-sign-on credentials and can affect Wi-Fi, Ethernet and VPN connections using MS-CHAPv2. Those conditions should not be merged with the automatic-protocol-selection fault. Nor is temporarily weakening Administrator protection a general VPN remedy.
Microsoft’s current Smart App Control FAQ describes enabling or re-enabling it on eligible devices after recent updates without necessarily reinstalling Windows. That differs from an older overview which still describes the clean-install requirement. The FAQ’s device eligibility and managed-device, developer, S-mode and diagnostic-data conditions still matter. An available switch is not evidence that a particular machine is protected or that an application will pass its checks.
Windows 11 24H2 no longer receives the optional non-security preview releases from October onwards. That is separate from the continued monthly security-update route for Enterprise and Education, and from the October end of ordinary servicing for Home and Pro. Match the edition, branch and update type before using a preview fix as a deployment instruction. BlackTree has not installed these previews or tested a VPN, remote sign-in or Smart App Control on a reader’s device.
The later changes also reach beyond VPNs. Microsoft’s 26 October revision of the exploited Windows Shell advisory added Edge software to its Security Updates table. Check the applicable product rows rather than assuming that a Windows operating-system KB settles every affected application. The current Windows Server 2016, 2019, 2022 and 2025 notes also describe an Exchange failure affecting web sign-in, mail delivery and mailbox replication. Installing Exchange’s own October security update is not required for that issue to occur. The notes link a conditional workaround and Microsoft Support mitigation; a successful Windows installation still needs a check of the actual mail workload.
Microsoft corrected the 23H2 KB heading on 16 October to 22631.7652, resolving the discrepancy described in the original report below. The current release-information table also lists the 26 October out-of-band KB5134130 at 22631.7654. The eight-row matrix below remains the 13 October security-update baseline, not a list of the latest cumulative builds as of this update. The 23H2 Enterprise and Education support notice gives 10 November as the final security-update date. Separately, the Windows 10 Enterprise LTSC 2021 note warns that free support ends on 12 January 2027; that is not a statement about every IoT edition.
Update, 1 November 2026: keep the release-count snapshots distinct
The 1,410-CVE and 70-Critical totals in the original report are our 14 October count. They should not be presented as a fresh count of the now-expanded live file. Microsoft’s CVRF, last revised on 31 October, currently contains 3,425 vulnerability records across its full scope. Selecting distinct CVE identities whose earliest recorded revision is 13 October at 07:00 gives 1,409 CVEs and the separate ADV260001 advisory, with 78 of those CVEs now rated Critical. The same selection from our retained 27 October capture gives the same later figures.
That is a real difference from the original snapshot. The sources reviewed here do not establish the exact cause of the change, so this update does not attribute it to a new release, withdrawn vulnerability or vendor counting error. Revision histories are not consistently in date order; selecting only the first array item would produce another, misleading denominator. Keep the dated figures and selection rule visible, and use the current product and advisory rows for deployment decisions.
Risk cohorts can reduce repeated analysis, not rank the exceptions
Microsoft’s 13 October risk-cohort proposal groups CVEs around shared questions about deployment, exposure and trust boundaries. The groupings are provisional and illustrative. Microsoft says they are not official vulnerability categories, do not change update guidance and are not currently shown in the Security Update Guide.
That makes a cohort useful as a worksheet, not a priority score. A team can answer once which hosts expose Remote Desktop roles or process untrusted Office content, then apply that context to the relevant CVEs. Active exploitation, authentication, attack vector, required privileges, user interaction and product guidance still decide which exceptions move first.
The exploited gap comes first
CVE-2026-96951 evades Windows Mark of the Web after user action; Microsoft reports exploitation. A malicious attachment is therefore a different priority from an unused server component. BlackTree’s separate Windows Shell report explains the attack path.
CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 13 October, with a 16 October remediation deadline for in-scope US federal systems. That is not a universal deadline for every organisation. It is nevertheless useful corroboration when deciding which outstanding change should move first.
Keep patch deployment and incident assessment separate. A corrected machine can still have an unanswered question about activity before the update. Where suspicious files or alerts already exist, preserve the relevant evidence and assess that exposure window rather than treating a completed installation as proof that nothing happened.
Service exposure changes the next priorities
Message Queuing CVE-2026-100202, QUIC CVE-2026-100219/CVE-2026-105016 and DHCP Server CVE-2026-96934 score 9.8: unauthenticated network code execution, none reported exploited.
For deployment planning, start with the application and network inventory, not the number of machines carrying the same operating-system label. Identify which hosts actually run the affected components and who can reach those services. A service accessible from an untrusted network deserves a different rollout position from a component that is absent or unreachable. Apply that assessment to internal networks too, not only the public internet.
Do not let a severity score become a substitute for that work. Conversely, a quiet monitoring dashboard is not a reason to wait for exploitation to become visible. Use the vendor’s affected-product list to establish applicability, then use exposure and the consequence of losing the service to order the change.
Public disclosure is a separate application risk
Public disclosures cover .NET Framework’s local bypass CVE-2026-108398 and MessagePack-CSharp’s network denial of service CVE-2026-92707. Neither is reported exploited.
Application owners should establish which deployed runtime or dependency carries the relevant fix, rather than assuming that a healthy Windows Update status settles every application question. Record the package or runtime actually in use and the application’s delivery route. The operational consequence is different for a local execution boundary and for a network-facing service whose availability is at stake.
The Windows update has to match the branch
The following matrix records the principal client and server branches in Microsoft’s 13 October security-update baseline. It is a deployment reference, not a claim that every listed edition remains in ordinary support or that one package fixes every Microsoft product.
| Windows branch | October update | Build to verify |
|---|---|---|
| Windows 11 26H1 | KB5127646 | 28000.3231 |
| Windows 11 26H2 / 25H2 / 24H2 | KB5127648 | 26300.9711 / 26200.9711 / 26100.9711, respectively |
| Windows 11 23H2 Enterprise and Education | KB5126653 | 22631.7652 |
| Windows 10 22H2 ESU / 21H2 LTSC 2021 | KB5126657 | 19045.7807 / 19044.7807, respectively |
| Windows Server 2025 | KB5126646 | 26100.33650 |
| Windows Server 2022 | KB5126655 | 20348.5761 |
| Windows Server 2019 / Windows 10 Enterprise LTSC 2019 | KB5126651 | 17763.9376 |
| Windows Server 2016 / Windows 10 Enterprise LTSB 2016 | KB5126868 | 14393.9612 |
For 23H2, Microsoft’s release-information table confirms 22631.7652, matching MSRC’s product rows. At the 14 October check, the KB5126653 page heading instead said 22621.7652; Microsoft corrected that heading on 16 October, as noted in the update above. Use the branch-specific value above; those numbers are not interchangeable.
For each rollout ring, retain the installed KB, the running build after restart and a functional check of the service the machine provides. A deployment system’s success status and a usable business application answer different questions. Standalone Windows 11 deployment also needs the checkpoint cumulative update sequence described in the relevant KB, not just the latest MSU file.
Remote access is the immediate rollout trap
Microsoft added a Remote Desktop issue on 14 October. Non-admin users can receive 0xC000000D when connecting to hosts with Administrator protection enabled. The KB5127648 notes then offered temporarily disabling that protection through managed policy while Microsoft prepared a future fix.
That workaround changes a protection, so it should not become the default long-term answer. Test an ordinary user’s remote sign-in as well as an administrator’s, establish an alternative management route before the wider change, and give any temporary policy exception an owner and a review point. A pilot that checks only administrative access can miss the affected workflow.
At the 14 October check, client notes also retained a partially resolved USB Audio Class 1.0 problem, with Code 10 failures or missing output on some devices. Include the actual headset or audio device used by affected staff in the pilot. Microsoft’s 23H2 notes then listed no known issues; that statement is time-specific, not a warranty that every local application will work.
On Windows Server 2025 and 2022, the notes say WSUS synchronisation error details remain unavailable following an earlier security hardening change. A missing diagnostic detail is not proof of successful synchronisation. Verify delivery through the relevant deployment records and client state instead.
Some patch dates are also support deadlines
October is the final monthly security update for Windows 11 24H2 Home and Pro, not Enterprise and Education. Windows 11 23H2 Enterprise and Education reach their final scheduled security update in November. Windows 10 Enterprise LTSB 2016 reaches the end of free support on 13 October.
Server 2022 is different: its mainstream support ended on 13 October, but extended support continues security updates through 14 October 2031. Do not turn that transition into a false claim that security patches have stopped. Equally, do not let a successful final client update hide the need for a supported migration or entitlement.
The immediate decision is to close the applicable security gaps while validating remote access and other essential workflows. The next decision is to retire or move the editions whose continuing update route has ended. Keeping those two workstreams distinct makes it possible to act urgently without confusing today’s patch result with next month’s support position.
How this release was counted
Original 14 October count: our CVRF selection contained 1,411 records, comprising 1,410 unique CVEs and the separate hardening advisory ADV260001. The dated update above discloses the different result from later captures. This article counts the CVEs first revised 13 October at 07:00; later records, product-row duplicates and the advisory are excluded. The illustrative cohort totals in Microsoft’s blog answer a different question and should not be substituted for the release count.
Primary evidence: release metadata, October CVRF, Windows Shell advisory, .NET Framework advisory, MessagePack-CSharp advisory, Message Queuing advisory, first QUIC advisory, second QUIC advisory and DHCP Server advisory. Branch-specific update notes are linked in the table. The original count and known-issue snapshot were checked on 14 October; the dated update above adds the 1 November review. Microsoft may revise this evidence.
