Microsoft shipped its October 2026 Patch Tuesday updates on October 13, closing out a record-setting month: 1,411 vulnerabilities fixed across Microsoft’s products, around 70 of them rated critical, plus two zero-days — one of which, CVE-2026-96951, Microsoft confirms is already being actively exploited. If you have been putting off this month’s update because the changelog reads like routine maintenance, the active-exploitation detail is the reason not to. Here is what is actually in it and which KB applies to your version of Windows 11.
Which KB You Need, by Version
- Windows 11 24H2, 25H2, and 26H2: KB5127648, moving builds to 26100.9711, 26200.9711, and 26300.9711 respectively.
- Windows 11 26H1: KB5127646, moving the build to 28000.3231.
- Windows 11 23H2: KB5126653, moving the build to 22621.7652.
Not sure which version you are on? Check Settings > System > About, or see our breakdown of 25H2, 26H1, and 26H2 if the naming is confusing.
Why This One Is More Urgent Than the Usual Roundup
CVE-2026-96951 lets an attacker run commands through the Windows Shell to bypass network security protections, and Microsoft has confirmed it is being actively exploited in the wild — not just disclosed ahead of exploitation, as most patched vulnerabilities are. That puts it in the small category of CVEs each year that security teams treat as patch-this-week rather than patch-this-quarter, regardless of whether any of the quality-of-life bugs below ever affected you. A second zero-day also shipped this month with disclosed details but no confirmed active exploitation yet.
What Else This Update Fixes
- Explorer crashes, sometimes a black screen after sign-in, in multi-user setups like Azure Virtual Desktop and FSLogix.
- An Always On VPN regression from KB5124008 that left connections stuck on “Connecting” or throwing a “port already in use” error.
- A printing failure with RAW and Generic Text Only drivers that started with August 2026’s update.
- Storage Spaces Direct tiered virtual disks that could fail to come online.
- Mouse-input stutter in some games, and a Windows Hello fingerprint sign-in failure after a cold boot.
- On 23H2 specifically: a File History fix for backups failing to an external drive or network location, plus a bogus “reconnect your drive” prompt.
- Continued Secure Boot certificate rollout, and new ReFS auditing for externally attached volumes (enabled by default; enforcement itself stays off for now, so this is logging, not a new restriction).
A Non-Security Change Worth Knowing About
This update also adds a new Manitoba Standard Time zone (UTC-05:00) and finalizes permanent Daylight Saving Time for British Columbia and Alberta, both ahead of the November 1, 2026 switch. If your clock looks “wrong” in early November and you are in one of those provinces, that is an intentional policy change arriving through this KB, not a bug.
How to Install It
Go to Settings > Windows Update > Check for updates, then restart. If you manage multiple machines, confirm the build number actually landed (26100.9711 / 26200.9711 / 26300.9711 / 28000.3231 / 22621.7652, depending on version) rather than trusting that “no pending updates” alone means you are current — Windows Update can occasionally report a device as up to date when a specific cumulative update stalled partway through installing.
What Not to Do
Do not skip this update because nothing in the quality-of-life list affects you personally. The actively exploited CVE is the actual reason to install it promptly, and it has nothing to do with whether you have hit the printing or VPN bugs. Do not confuse this release with last month’s update either — our KB5124008 known issues roundup covers a different set of September bugs, some of which this month’s Always On VPN and printing fixes are specifically patching.
Known Issues and the Honest Limitation Here
As of this writing, no new unresolved known issues have been reported for KB5127648, KB5127646, or KB5126653 — but that status can change in the days after release, since problems sometimes surface only once an update reaches a wider install base. If you hit something unexpected right after installing, check the Windows Release Health dashboard before assuming it is unrelated to the update.
This is not the first time a privilege-escalation style flaw in a Microsoft security component has outpaced its own fix. Our look at the ShieldBreak and ShieldCrash Defender flaws walked through a similar cat-and-mouse pattern earlier this year, and the lesson carries over here: install promptly, and do not wait for “the next one” to catch up on patches you skipped.
FAQ
What is the most important fix in October 2026’s Patch Tuesday?
CVE-2026-96951, a zero-day that lets an attacker run commands through the Windows Shell to bypass network security protections. Microsoft confirms it is being actively exploited, which is why this update is worth installing promptly rather than deferring.
Which KB do I need for my version of Windows 11?
KB5127648 for 24H2, 25H2, and 26H2; KB5127646 for 26H1; and KB5126653 for 23H2. Check Settings > System > About if you are not sure which version you are running.
How many vulnerabilities did Microsoft patch this month?
1,411 across Microsoft’s products in October 2026’s Patch Tuesday, including roughly 70 rated critical and two zero-days u2014 a record for a single Patch Tuesday.
Are there any known issues with this month’s update?
None had been reported as of this writing for KB5127648, KB5127646, or KB5126653. Known issues can still surface after wider release, so check the Windows Release Health dashboard if something seems off after installing.