Microsoft shipped its October 2026 security updates on October 13. This month carries one actively exploited vulnerability, a pile of critical Outlook bugs that trigger from the Reading Pane, a known issue that can take on-prem Exchange down after the server patches, and an end-of-updates milestone for a lot of home and small office PCs.

Here is what to install, what broke, and the fix for each problem Microsoft has acknowledged so far.

The Updates by Version

Windows 11 24H2, 25H2 and 26H2: KB5127648, bringing builds 26100.9711, 26200.9711 and 26300.9711. It includes servicing stack update KB5127647.

Windows 11 23H2: KB5126653, build 22631.7652. Enterprise and Education editions of 23H2 get one more update, in November, and then reach end of updates on November 10, 2026.

Windows 11 26H1: KB5127646, build 28000.3231.

Windows 10 22H2 and 21H2 with ESU: KB5126657, builds 19045.7807 and 19044.7807.

Windows Server: KB5126646 for Server 2025, KB5126655 for Server 2022, KB5126651 for Server 2019, and KB5126868 for Server 2016.

Two lifecycle notes ride along. KB5127648 is the last monthly update for Windows 11 24H2 Home and Pro, so those PCs need to move to a newer version to keep getting security fixes. We covered that deadline in detail in Windows 11 24H2 Home and Pro End of Updates. Windows Server 2022 also left mainstream support with this release. It moves to extended support and keeps getting monthly security updates through October 14, 2031.

The Zero-Day: Windows Shell Security Feature Bypass

Microsoft marked CVE-2026-96951 as exploited in the wild. It is a command injection flaw in Windows Shell that lets an attacker slip past Mark of the Web, the tag Windows puts on downloaded files so SmartScreen and Office Protected View know to treat them with suspicion. MSRC rates it Important with a CVSS score of 8.8.

Exploitation needs a user to act. Microsoft describes the attack as a crafted file or link sent by email or instant message that the victim has to open or click. That makes it a phishing tool, built for the inbox your staff already trusts. Every supported Windows client and server version is on the fix list, so this one alone is reason enough to patch this week.

Two more CVEs were publicly disclosed before the patch, though neither is exploited. The one that matters is CVE-2026-108398, a .NET Framework flaw that can let an attacker who already has access bypass Windows Defender Application Control enforcement. If you rely on WDAC or App Control for Business, make sure the .NET Framework updates went in alongside the Windows update. The other, CVE-2026-92707, is a low-severity denial of service bug in the MessagePack-CSharp library.

Outlook Bugs You Can Trigger Without Clicking

The scariest part of this release is in Office. Several Outlook remote code execution bugs carry a CVSS score of 9.8, including CVE-2026-97016 and CVE-2026-70242. For both, Microsoft says simply viewing a crafted message in the Outlook Reading Pane could trigger the vulnerability, without the recipient opening the message or clicking anything in it. Microsoft rates exploitation as less likely and none are known to be exploited yet, but an attack that needs nothing more than an email landing in a mailbox is the kind that gets weaponized quickly.

These are Office fixes, not Windows fixes. Microsoft 365 Apps pick them up through their own update channel, so check that Office is actually updating on your PCs. A machine that shows the October Windows build can still be running an old Outlook.

Server Roles to Patch First

Windows DHCP Server. CVE-2026-96934 is rated Critical at 9.8. Microsoft says an unauthenticated attacker could exploit it by sending a specially crafted packet over the network, with no user interaction. If a Windows server hands out your IP addresses, it goes to the front of the line.

Message Queuing. CVE-2026-100202 in the MSMQ Queue Manager is also a 9.8. It only matters on systems with the Message Queuing service installed, but anything running it is reachable over the network. Check with a quick look at your servers’ roles and features.

Known Issue: Exchange Mail Stops Flowing After Server Updates

This is the one most likely to ruin a morning. After installing the October update on Windows Server 2025 or 2022, some on-premises Exchange servers have trouble sending or accessing mail. Users cannot sign in to Outlook on the web, messages sit in the Outbox, mail queues grow, and OWA can fail with MapiExceptionMdbOffline and Event ID 1006 in the application log. You do not need to install October’s Exchange updates to hit it.

The cause is a new default limit on how much memory Endpoint Mapper uses for Endpoint Lookup calls. Busy Exchange servers can exceed the default of 512 simultaneous calls. The Exchange team’s fix is a registry value, followed by a reboot:

reg add "HKLM\SOFTWARE\Microsoft\Rpc" /v EpmapSavedContextCap /t REG_DWORD /d 65536 /f

Microsoft explicitly says not to uninstall the October Windows Server update to work around this. The value is only read once the October update is installed, so you can set it ahead of time on Exchange servers you have not patched yet.

Known Issue: Remote Desktop Fails With 0xC000000D

Non-admin users may be unable to connect over Remote Desktop to a device that has Administrator protection turned on. The connection fails with error 0xC000000D and the message "The token that was passed to the function is invalid." This started with the September 22 preview update and carries into October. It mostly hits managed machines used as Remote Desktop hosts, and it matters if you use Microsoft’s security baselines, which turn Administrator protection on by default for 24H2, 25H2 and 26H2.

Microsoft’s mitigation is to temporarily turn off Administrator protection on the affected hosts by resetting the User Account Control Type Of Admin Approval Mode policy in Intune or Group Policy. A permanent fix is promised in a future update.

Known Issue: Smart App Control Will Not Turn Back On

On some devices where Smart App Control was switched off, the toggle to turn it back on is grayed out after this update. Machines where it was already on are fine and stay protected. Microsoft published a registry workaround, run from an elevated Command Prompt and followed by a restart:

reg add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 2883193997 /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 2850574478 /t REG_DWORD /d 1 /f

Managed environments can deploy the same change with two special Group Policy downloads linked from the KB5127648 page instead of touching the registry by hand.

Still Open: USB Audio Class 1.0 Devices

Some older USB audio devices stopped working after the September 8 security update, showing Code 10 in Device Manager or producing no sound. The September 14 out-of-band update fixed the 8-channel and 3D audio cases, but other symptoms remain open in October for both Windows 11 and Windows 10. If a USB headset or interface died last month and is still dead, this is why. Microsoft points businesses that need a workaround now to Microsoft Support for Business.

A Change That Can Break Wi-Fi and VPN

This one is a deliberate security change rather than a bug. KB5127648 switches the default handling of NTLMv1-derived credentials for single sign-on from audit to enforce on devices where Credential Guard is off and the BlockNtlmv1SSO registry value is not set. Microsoft warns it might affect Wi-Fi, Ethernet and VPN connections that use MS-CHAPv2. If users suddenly cannot connect to a corporate wireless network or an older VPN after patching, start there and read Microsoft’s KB5066470 guidance before rolling anything back.

It is the same direction Microsoft took with Kerberos earlier this year: old authentication gets turned off by default, and whatever still depends on it breaks. Our post on Kerberos RC4 enforcement walks through how to find those dependencies before they find you.

What October Fixed

Some good news too. KB5127648 fixes the Explorer.exe crash and black screen at sign-in on multi-user systems like Azure Virtual Desktop and FSLogix, the AC-3 audio playback problem from September, and printing failures with RAW and Generic Text Only printer drivers that started with the August security update. It also fixes fingerprint sign-in failing after a cold boot on some devices, mouse stutter in some games, and tiered Storage Spaces Direct virtual disks that would not come online.

Since Patch Tuesday, Microsoft has published one out-of-band release: KB5133047 on October 16, an out-of-box experience update for Windows 11 26H1 that only applies during device setup.

Check What You Have Installed

Run this in PowerShell to see the exact build and whether the October updates are present:

# Exact OS build. 26100.9711, 26200.9711 or 26300.9711 means October is installed on Windows 11
$cv = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion"
"{0} build {1}.{2}" -f $cv.DisplayVersion, $cv.CurrentBuild, $cv.UBR

# Look for the October 2026 cumulative updates by KB number
Get-HotFix | Where-Object HotFixID -in "KB5127648","KB5126653","KB5126657","KB5126646","KB5126655" |
  Select-Object HotFixID, InstalledOn

Our order for this month: Exchange servers get the registry value first and then the update, DHCP servers next, then every workstation, with Office updates checked on each one.

References

Need October patches rolled out without taking Exchange or Remote Desktop down? Contact Rain City Techworks.