October 2026 Patch Tuesday: Windows Admin Priorities

Microsoft released the October 2026 Patch Tuesday updates on 13 October 2026. There is one exploited zero-day: CVE-2026-96951, a Windows Shell security feature bypass. CISA added it to KEV the same day. You also get three Windows 11 cumulative updates, AD FS and ReFS hardening changes, two lifecycle deadlines, and a carried-over USB audio known issue. The Exchange CVE you will see in most roundups, CVE-2026-96940, shipped on 2 October in a reissued Exchange SU. It is not fixed by the Windows LCU.

October 2026 Patch Tuesday CVEs: the counts and the zero-day

Microsoft's October 2026 CVRF (version 1.0, published 13 October) lists 1,759 entries. 1,417 have Microsoft as the CNA. The other 342 are third-party and open-source CVEs, mostly Linux and Apache components. By Microsoft's maximum severity rating, the Microsoft entries break down as 76 Critical, 1,337 Important and 1 Low. The total includes cloud-only CVEs that need no customer action and an advisory, so don't brief it as "1,417 patches to deploy". Some trackers published much smaller October totals before the full document was available. Use the CVRF or release note.

Exploited: CVE-2026-96951, Windows Shell security feature bypass, Important, CVSS 8.8. Microsoft describes it as command injection in Windows Shell that lets an unauthorised attacker bypass a security feature over a network. It is fixed by KB5127648, KB5126653, KB5127646 and the matching Windows 10 and Server packages listed in the CVRF. CISA added it to KEV on 13 October with a federal due date of 16 October 2026.

Publicly disclosed, not exploited: CVE-2026-108398, a local .NET Framework security feature bypass (untrusted search path), CVSS 8.8. It ships in the separate .NET Framework packages, not in the Windows LCU on every SKU.

Critical cloud CVEs, no customer action: CVE-2026-77900 (Azure App Service RCE) and CVE-2026-88131 (Microsoft Dataverse RCE) were published on 8 October as Critical. Microsoft lists them as not exploited and not publicly disclosed. They are service-side fixes.

For ring design, reuse the Patch Tuesday Intune and WUfB operations guide. This page is the October-specific briefing.

October 2026 Patch Tuesday KBs and builds to verify

Use the KB and OS build as the compliance target. An assigned quality-update policy is not proof the device restarted onto the October build.

Windows 10 ESU and Windows Server packages are not listed here because I had not verified them against Microsoft Support at review time. Take them from the release note, not from a blog table.

Servicing stack updates in the October packages

• KB5127648 includes SSU KB5127647 (26100.9703).
• KB5126653 includes SSU KB5126652 (22621.7641).
• KB5127646 includes SSU KB5127645 (28000.3225).

If you service offline images, record the SSU with the LCU.

KB5127648: Windows 11 26H2, 25H2 and 24H2

KB5127648 includes servicing stack update KB5127647. The Catalog package lists checkpoint cumulative update KB5043080 as a prerequisite, so keep both MSU files in the same folder if you service images with DISM.

Fixes worth mapping to open tickets:

• Explorer black screen on AVD and FSLogix. Explorer.exe could fail to start or crash repeatedly after sign-in in multi-user environments.
• Always On VPN after KB5124008. Connections using automatic protocol selection or fallback could stick in Connecting, sometimes with "The specified port is already in use."
• Tiered Storage Spaces Direct virtual disks failing to come online after certain security updates.
• AC-3 audio playback in some applications, the known issue introduced by KB5124010.
• Printing with RAW or Generic Text Only drivers after the August update.
• Bluetooth audio crash (0x139) while streaming, plus Bluetooth reliability work and persistence of the multi-app camera setting.

It also adds ReFS auditing for removable media (see below) and the new Manitoba time zone.

The September Credential Guard domain-trust issue is shown as resolved by KB5124010 on 24H2 release health, so KB5127648 carries that fix forward. It is not new this month.

KB5126653: Windows 11 23H2

KB5126653 moves 23H2 to 22621.7652, with SSU KB5126652. It is the update that fixes the September File History "Reconnect your drive" issue on 23H2. Microsoft lists no known issues for this package.

Windows 11 23H2 Enterprise and Education reach end of updates on 10 November 2026. November's update is their last.

KB5127646: Windows 11 26H1

KB5127646 takes 26H1 (Arm64) to 28000.3231. It shares the Explorer, Always On VPN and Storage Spaces Direct fixes with KB5127648.

Exchange CVE-2026-96940: KB5129955 to KB5129958

CVE-2026-96940 is an Exchange Server elevation of privilege, CVSS 8.8, that Microsoft rates Exploitation More Likely. An authenticated user can read other mailboxes and attachments in the same organisation. Microsoft says it found the flaw internally and is not aware of exploitation, and it is not on the CISA KEV catalog as of this review.

Patched builds: Subscription Edition RTM 15.02.2562.053, 2019 CU15 15.02.1748.053, 2019 CU14 15.02.1544.048, 2016 CU23 15.01.2507.075. Servers that installed only the original September SU are still vulnerable. The CVRF maps the fix to four Exchange packages, KB5129955, KB5129956, KB5129957 and KB5129958, one per supported build line (Subscription Edition RTM, 2019 CU15, 2019 CU14 and 2016 CU23). These are the September 2026 v2 SUs, published 2 October. Install the right one on every Exchange server and every machine running the Exchange Management Tools. 2016 and 2019 get it only through Period 2 ESU.

Hardening changes that land in October

AD FS DKM container ACL enforcement (CVE-2026-56155)

From the October 2026 update, AD FS automatically fixes insecure Distributed Key Manager (DKM) container ACLs on Windows Server 2016 and later. This is the enforcement phase of KB5121391, the CVE-2026-56155 hardening that started in audit mode in July. It behaves as if RemediateDkmAcl = 1 under HKLM\SOFTWARE\Microsoft\ADFS. Setting it to 0 opts out, and Microsoft says that leaves the container vulnerable. Server 2012 and 2012 R2 are not remediated automatically; Microsoft documents a manual sequence for them. Before you patch the farm, check the AD FS Admin log for Event ID 1132.

ReFS on removable media: audit now, block in January 2027 (KB5130741)

KB5130741 starts the audit phase with the October update. When a ReFS volume is mounted from removable or externally attached media, Windows logs System Event ID 524 (source ReFS, Warning). The January 2027 security update turns on blocking by default. Control it with RefsRemovableDeviceMountPolicy (0 Off, 1 Audit, 2 Block) through Group Policy or the registry. A restart is needed after you change it. Collect Event 524 from your fleet now.

Administrator protection is enabled by the baseline, not by the update

Administrator protection is off by default on Windows 11, according to Microsoft's 26H2 what's new page. The October cumulative update does not switch it on. Microsoft's updated Windows 11 security baseline does enable it through policy. If you import that baseline, test it in pilot first. It is not supported on AVD session hosts or Windows 365 Cloud PCs.

Secure Boot: extra restart and boot.stl

Secure Boot certificate delivery continues. Expect an extra restart on some devices. If you add dynamic updates to media, include boot.stl or the media can fail with 0xc0430001 (details below).

Windows Server 2022 leaves mainstream support

Per the Windows Server 2022 lifecycle page, mainstream support ends with this release on 13 October 2026 (Microsoft lists the cut-off as 14 October, 06:59 PT). Security updates continue through extended support until 14 October 2031 (cut-off 15 October 2031, 06:59 PT). Non-security fixes and Azure Edition hotpatching end with mainstream support.

24H2 Home and Pro reach end of updates

KB5127648 is the last update for Windows 11 24H2 Home and Pro. Enterprise and Education 24H2 stay supported until 12 October 2027. 23H2 Enterprise and Education get their last update in November 2026. The October servicing deadlines briefing has the inventory queries. Any Pro device in a BYOD or small-office group now needs a feature update target, not another quality ring.

What to patch first

1. CVE-2026-96951 (exploited). Take the October LCU to internet-facing user endpoints first, especially privileged and admin workstations, within days rather than the normal broad-ring window.
2. On-premises Exchange, if any server is still below the v2 builds above. This is a separate change from Windows.
3. AVD, FSLogix and Always On VPN cohorts, because KB5127648 fixes faults those users already have. Pilot here first.
4. Storage Spaces Direct clusters, in redundant waves. Validate virtual disks come online before the next node.
5. AD FS farms: check Event 1132 before you patch, then confirm the service starts.
6. The rest of Windows 11 through normal rings.
7. 24H2 Home/Pro devices: move them to 25H2 or 26H2.

The September exploited CVEs, CVE-2026-81963 and CVE-2026-85880, are on CISA KEV. October cumulative updates include them, so any device that missed September closes them by taking October. See the September briefing.

Intune and Configuration Manager deployment tips

Intune / WUfB. Keep canary, pilot and broad rings. Check compliance with the build in the table, not policy assignment. Keep expedite policies for the cohorts that need a specific fix.

Configuration Manager / WSUS. The Windows 11 packages sync under Product Windows 11, Classification Security Updates. Run your normal WSUS cleanup before the sync. Exchange SUs are not in a Windows 11 ADR, so check they are covered by your Exchange process.

Offline media. If you add dynamic updates to images, include boot.stl from Windows\Boot\EFI. Microsoft warns that missing it can stop media booting with 0xc0430001. The Update WinPE script handles this.

Quick device check:

Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' |
    Select-Object DisplayVersion, CurrentBuild, UBR

Get-HotFix |
    Where-Object HotFixID -in 'KB5127648','KB5126653','KB5127646' |
    Select-Object HotFixID, InstalledOn

Expect UBR 9711 on 26H2/25H2/24H2, 7652 on 23H2 and 3231 on 26H1.

Known issues to test

• USB Audio Class 1.0 devices (KB5127648, KB5127646). Since the September update some devices show Code 10, have no output, or have dead volume controls. The 14 September OOB fixed 8-channel and 3D audio modes only. Test conference-room and USB headset hardware in pilot. Microsoft points admins to Support for Business for a workaround.
• Secure Boot certificate rollout continues. Expect an extra restart on some devices, as in September. See the Secure Boot CA 2023 readiness guide.
• ReFS auditing is new. Watch for Event 524 on external ReFS volumes before blocking becomes the default in January 2027.
• AD FS after DKM ACL enforcement: confirm token signing works and look for Event 1136 (remediation failed).

Microsoft lists no known issues for KB5126653. Re-check Windows release health before promoting each ring.

FAQ

What is the October 2026 Patch Tuesday KB for Windows 11?

KB5127648 for 26H2, 25H2 and 24H2 (builds 26300.9711, 26200.9711, 26100.9711), KB5126653 for 23H2 (22621.7652), and KB5127646 for 26H1 (28000.3231).

Are there zero-days in October 2026 Patch Tuesday?

Yes, one. CVE-2026-96951, a Windows Shell security feature bypass (CVSS 8.8), is marked exploited by Microsoft and was added to CISA KEV on 13 October 2026. CVE-2026-108398 (.NET Framework) was publicly disclosed but is not exploited.

How many CVEs did Microsoft fix in October 2026?

The October CVRF lists 1,759 entries: 1,417 with Microsoft as CNA (76 Critical by maximum severity) and 342 third-party or open-source CVEs. Use the release note, not a blog total.

Does KB5127648 fix Exchange CVE-2026-96940?

No. Exchange needs the September 2026 v2 Security Update for your CU: KB5129955, KB5129956, KB5129957 or KB5129958.

Is this the last update for Windows 11 24H2?

For Home and Pro, yes. Enterprise and Education remain supported until 12 October 2027.

Is the USB audio issue fixed?

Partly. Multichannel modes were fixed in September. Code 10 and no-output symptoms remain open.

Related reading

• Patch Tuesday operations for Intune and WUfB
• September 2026 Patch Tuesday admin priorities
• October 2026 Windows servicing deadlines
• Windows 11 26H2 enablement package pilot gate
• Patch management hub