November Patch Tuesday lands on the 10th: what October’s record release tells us

Microsoft’s next round of security updates arrives on Tuesday 10 November 2026, the second Tuesday of the month. If October is anything to go by, it will be big.

October set a new record

Microsoft’s 13 October release was the largest Patch Tuesday so far. Rapid7, which analyses every release, counted 1,413 vulnerabilities in Microsoft’s own products, 1,102 of them in Windows, and called it “much bigger still” than September’s release, which had itself set a record. Other trackers’ totals differ slightly, depending on which products they count.

The one that was already being exploited

CVE-2026-96951 is a security feature bypass in Windows Shell that was being exploited before the fix. Its value to attackers is that it gets around Mark of the Web, the tag Windows puts on files downloaded from the internet. Without that tag, Windows doesn’t warn you that a file came from the internet before you open it.

An attacker still has to get you to open a crafted file or visit a malicious site, but removing the warning makes that much easier. CISA added it to its Known Exploited Vulnerabilities catalog on 13 October, the day the fix shipped, and gave US federal agencies until 16 October to patch.

Publicly disclosed, not yet exploited

• CVE-2026-108398, a .NET Framework security feature bypass. An attacker who already has a foothold could get a protected process to load a malicious .NET assembly, getting around App Control for Business (formerly Windows Defender Application Control).
• CVE-2026-92707, a denial-of-service bug in the MessagePack-CSharp library (CVSS 5.3).

Five Outlook bugs that need no click

Rapid7 highlighted five remote code execution flaws in Outlook (CVE-2026-70242, CVE-2026-97749, CVE-2026-97016, CVE-2026-88156 and CVE-2026-70291) where the preview pane is an attack vector. Outlook may show the preview without you doing anything at all. If you only patch a handful of things quickly, Office belongs on that list.

End of support arrived the same day

For some products, October’s updates were the last ones:

• Windows 11 version 24H2, Home and Pro editions: Microsoft says the October 2026 security update is the last one for these editions. Update to a newer version of Windows 11 to keep receiving fixes.
• Office 2021, including Office LTSC 2021: support ended on 13 October, with no extension and no extended security updates.
• Windows Server 2012 and 2012 R2: the third and final year of paid extended security updates ended.
• Windows Server 2022 moved from mainstream to extended support, so it keeps getting security fixes.

Anything that is now out of support won’t be fixed on 10 November, however serious the bugs are.

How to plan for 10 November

1. Patch anything already being exploited first. Check Microsoft’s release notes and CISA’s KEV catalog on the day.
2. Then internet-facing and mail systems: Exchange, SharePoint, remote access servers, and Office and Outlook on every desktop.
3. Then everything else inside your normal testing window.
4. Find your unsupported systems now, before the updates land, and decide whether to upgrade them, isolate them or retire them.

Run Linux servers too? Don’t let Patch Tuesday crowd out the bugs being exploited right now on the other side of the fence: php2shell in PHP and the “sshole” OpenSSH password bypass.

Sources

• Rapid7: Patch Tuesday, October 2026 (opens in a new tab)
• CISA: CISA adds two known exploited vulnerabilities to catalog (13 October 2026) (opens in a new tab)
• CISA KEV catalog entry: CVE-2026-96951 (opens in a new tab)
• Microsoft: End of support for Office 2021 (opens in a new tab)
• Microsoft Lifecycle: Office LTSC 2021 (opens in a new tab)
• Microsoft: Windows message center (opens in a new tab)