Microsoft’s October 2026 security update addresses 1,415 vulnerabilities across multiple products, according to InfoQ. The report says 85 are classified as critical and that a Windows Shell vulnerability has been exploited.
The Windows Shell flaw, CVE-2026-96951, can allow an attacker to bypass Mark of the Web security protections. Microsoft described maliciously crafted files delivered by email or instant message as a potential attack route. Exploitation still requires a user to take an action, such as opening a malicious attachment or following a link; an attacker cannot force someone to view the content.
The update covers Windows, Office, Exchange, .NET and Edge, and may also affect Hyper-V and Azure components. InfoQ also notes that CVE-2026-108398, a .NET Framework security-feature bypass, was publicly disclosed before the update. Microsoft reported no evidence that this flaw had been exploited.
The size of the release adds to the work of testing and deploying patches. Two Reddit users reported connectivity problems after installing KB5127648: one with WPA-Enterprise Wi-Fi and another with IPSec VPN on some laptops. These are user reports, not confirmation of a widespread issue. Staged deployment and monitoring may help teams identify problems before rolling the update out more broadly.