October 2026 Patch Tuesday: What Indian IT Teams Must Do

In short: Microsoft released its October 2026 security updates on 13 October 2026, fixing about 1,400 vulnerabilities, including a Windows Shell flaw already being exploited by attackers. Indian businesses and departments should patch internet-facing Exchange and Active Directory servers and user PCs first, check for end-of-support systems, and confirm the updates actually installed.

What Happened

On Tuesday, 13 October 2026, Microsoft released its monthly security updates, known as Patch Tuesday. The release is unusually large. Tenable counts 1,407 CVEs across 301 products and calls it Microsoft's largest Patch Tuesday release so far, while BleepingComputer and Windows Report put the total at 1,411. The small difference comes from how each source counts, so treat the figure as "about 1,400". Microsoft's own list is in the Microsoft Security Update Guide.

The most urgent item is CVE-2026-96951, a security feature bypass in Windows Shell. According to Tenable and Windows Report, it has been exploited in the wild. It lets an attacker get around Mark of the Web, the Windows protection that warns users before opening files downloaded from the internet or received by email. In practice, that means a malicious attachment or download could open with fewer warnings.

Sources differ on the zero-day count. Windows Report and BleepingComputer list three zero-days: the exploited Windows Shell flaw, plus two publicly disclosed flaws, CVE-2026-108398 in .NET Framework (a Windows Defender Application Control bypass) and CVE-2026-92707 in MessagePack-CSharp (a denial-of-service issue). Tenable describes CVE-2026-108398 as publicly disclosed but focuses on one exploited zero-day. All sources agree that only the Windows Shell flaw is confirmed as exploited.

Who Is Affected

Almost every organisation that runs Windows. Tenable highlights several other serious fixes that Microsoft rates as "exploitation more likely", including:

• Exchange Server: a remote code execution flaw (CVE-2026-70571) that can be triggered by a malicious email, and a spoofing flaw (CVE-2026-70279).
• Active Directory Domain Services: a critical remote code execution flaw (CVE-2026-70229).
• Microsoft Office Excel, Windows DNS Server and the Windows kernel: the products with the most fixes this month, according to Tenable.

Organisations still running on-premise Exchange, domain controllers exposed to large networks, or old Windows versions carry the most risk.

What It Means for Indian Businesses and Departments

Many Indian offices patch PCs when users get around to restarting, and patch servers only during rare maintenance windows. A month with an exploited flaw that targets email attachments and downloads is exactly when that habit becomes risky. Government departments and PSUs that still run on-premise Exchange or older servers should treat this release as a priority.

There is also an end-of-support angle. Tenable notes that Windows Server 2012 and 2012 R2 no longer receive security updates, and that Office 2021, Office LTSC 2021 and Windows 11 Home and Pro version 24H2 have reached the end of their support. Systems on these versions did not get this month's fixes. Our earlier post on Office 2021 end of support explains the options, and our guide to the Windows 10 ESU deadline covers older PCs.

In May 2026, CERT-In guidance, as reported by The Hacker News and Infosecurity Magazine, set indicative timelines for fixing known exploited vulnerabilities on internet-facing and high-value systems, starting at 12 hours. These were described as expectations rather than binding rules. Check with your security adviser how they apply to your organisation.

What to Do Now

1. Patch internet-facing servers first. Apply the October updates to Exchange servers, domain controllers and any Windows server reachable from the internet, after a quick test on one system.
2. Push updates to user PCs this week. The exploited Windows Shell flaw targets users who open files, so make sure laptops and desktops, including those of staff working from home, install the October updates and restart.
3. Find unsupported systems. List machines still on Windows Server 2012 or 2012 R2, Office 2021 or Windows 11 24H2 and plan upgrades, because they did not receive these fixes.
4. Remind staff about attachments. Send a short note asking staff not to open unexpected attachments or downloads, and to report suspicious emails.
5. Verify, do not assume. Use your patch management or endpoint tool to confirm that updates actually installed, and follow up on devices that failed.

If you do not have a regular monthly routine, our guide to the patch management process shows how to set one up.

Frequently Asked Questions

Which October 2026 flaw should we fix first?

CVE-2026-96951 in Windows Shell is the one confirmed as exploited, so user PCs matter. On the server side, Tenable highlights the Exchange Server and Active Directory flaws as likely to be exploited, so internet-facing Exchange and domain controllers should be next.

Why do sources give different totals?

Security vendors and news sites count CVEs slightly differently, for example by including or excluding third-party and browser components. Tenable reports 1,407 and BleepingComputer reports 1,411. The exact number matters less than patching the high-risk items.

We use Microsoft 365 online. Do we still need to patch?

Microsoft patches its cloud services itself, but your Windows PCs, installed Office apps and any on-premise servers still need the October updates.

How Affix Center Can Help

Affix Center is a Mumbai-based IT company that helps businesses and government departments keep systems patched and secure. Our IT AMC services and cyber security team can roll out the October updates, find unsupported systems and set up a monthly patching routine with reports you can show auditors. Contact our team if you need help this week.