Microsoft classifies 85 of the 1,416 vulnerabilities as “critical,” including 67 remote code execution (RCE) vulnerabilities. The other vulnerabilities are classified as “high risk,” with one vulnerability already being exploited in the wild while two were publicly known in advance.
The next Patch Tuesday is scheduled for November 10th, 2026.
Windows security vulnerabilities
A large number of the vulnerabilities—over 1,000 this time—are spread across the various Windows versions (10, 11, Server) for which Microsoft still provides security updates, including Windows 10 via the Extended Security Updates program, which was extended until October 12th, 2027.
Note: If you’re still on Windows 11 24H2, this is your last Patch Tuesday. Computers running 24H2 will no longer receive security updates going forward. When prompted by Windows Update, you should upgrade to Windows 11 25H2 or 26H2. That’ll keep you secure and up to date.
Windows under attack
One Windows security vulnerability is already being exploited in the wild this month. CVE-2026-96951 in the Windows Shell allows attackers to bypass the system’s defenses by disguising the origin of an executable file from the internet (Mark of the Web, or MotW).
Critical Windows vulnerabilities
Microsoft has classified 42 Windows vulnerabilities as critical, including 30 RCE vulnerabilities. Via these flaws, an attacker could remotely execute injected code without authentication or user interaction. The malicious code could then spread further across the network.