Virtual Administrator’s October 2026 Patch Recommendations
All new patches will be approved in our patch policy.
This month Microsoft released patches for 1,407 vulnerabilities with 70 rated “Critical” in severity. Another record setting month (and year). 1,407 is a monthly record and surpasses the previous yearly record in 2020 of 1,261 CVEs. We have two zero days(CVE-2026-96951,CVE-2026-108398).
- CVE-2026-96951 exploited in the wild and is a security feature bypass in the Windows Shell that affects Windows 10/11 and some Server versions.
- CVE-2026-108398 is a security feature bypass in the .NET Framework.
- There are a number of known issues this month. Please carefully review “Known Issues” below. Exchange admins may want to delay releasing the Server CUs.
- New standalone SSUs for Windows 10 1607/Server 2016 and Server 2012/2012R2.
- Windows 11 26H2 was released and this month is the final CU for Windows 11 24H2.
- Windows Server 2022 has reach end of mainstream support.
Last month all the CUs had bugs and Microsoft released Out-of-Band (OOB) CUs on September 14th. We will update this post, as needed, with any new developments this month.
Disclosed: CVE-2026-108398
Exploited: CVE-2026-96951
Security Update Guide
Microsoft Security Advisories
ADV990001 | Latest Servicing Stack Updates (Published:3/1/2018 | Last Updated: 10/13/2026)
https://msrc.microsoft.com/update-guide/en-us/vulnerability/ADV990001
Reason for Revision: A Servicing Stack Update has been released for some versions of Windows.
NOTE: The Windows 10 Security Stack Updates are included in the monthly Cumulative Updates.
ADV260001 | Hardening changes for ReFS volumes on removable media
https://msrc.microsoft.com/update-guide/vulnerability/ADV260001
Summary: Starting with Windows updates released on and after October 13, 2026, Microsoft is making hardening changes to the Resilient File System (ReFS). This change is not enable by default until 2027. Please see Hardening changes for ReFS volumes on removable media for more information.
FYI “Windows 11 26H2 officially released on September 29, 2026”
How to get the Windows 11 2026 Update https://blogs.windows.com/windowsexperience/2026/09/29/how-to-get-windows-11-2026-update/
“Windows 11, version 24H2 Home and Pro has reached end of updates.”
https://support.microsoft.com/en-us/servicing/os/windows-11/2026/10/kb5127648-windows-11-24h2-25h2-26h2-security-update The October 2026 monthly security update is the last update available for these editions. Windows 11 release information https://learn.microsoft.com/en-us/windows/release-health/windows11-release-information
“Windows Server 2022 has reach end of mainstream support.”
The October 2026 security update is the last mainstream support update available for this version. After this date, Windows Server 2022 will transition to extended support, which includes security updates at no additional cost, and will continue to receive monthly security updates through October 14, 2031.
Fixed Lifecycle Policy https://learn.microsoft.com/en-us/lifecycle/policies/fixed
Heads Up! “Manage changes to NTLMv1 and prevent network issues in Windows 11 and Windows Server 2025”
Beginning with the October 2026 Windows security update, released on October 13, 2026, Microsoft strengthens NTLMv1 security by changing the internal default behavior when the BlockNtlmv1SSO registry value is not set. Windows uses Enforce mode (1) instead of Audit mode (0). In Enforce mode, requests to generate NTLMv1-derived credentials for Single Sign-On are blocked instead of only being audited. This change might affect environments that still rely on NTLMv1-derived credentials for Single Sign-On, including certain Wi-Fi, Ethernet, and VPN authentication configurations that use MS-CHAPv2.
Temporary security exception If an organization identifies a critical authentication dependency that cannot immediately be migrated, setting BlockNTLMv1SSO to 0 (Audit) temporarily allows NTLMv1-derived Single Sign-On credentials while remediation is completed.
Open regedit as admin. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 Create a DWORD 32 bit with the name of BlockNtlmv1SSO and assign the value to 0.
Known Issues
There are a number of issues this month listed below. Those running Exchange servers may want to delay approving the October Server CU. The Exchange CU themselves appear to be safe, Microsoft continues to list unresolved older problems under the Known Issues for new patches. So if you have not yet experienced one of these issues it is unlikely it will occur now. Good resource for known issues with Windows 10/11/Server patches. Find the version and click on “Known issues”.
Windows release health https://docs.microsoft.com/en-us/windows/release-health/
“USB Audio Class 1.0 devices with error Code 10 or no output”
Affect: Windows 10/11, Windows Server 2016/2019 (KB5127646,KB5127648,KB5126651,KB5126657,KB5126868) https://support.microsoft.com/en-us/servicing/os/windows-11/2026/10/kb5127648-windows-11-24h2-25h2-26h2-security-update
Symptoms: After installing the September 8, 2026, Windows security update, some USB Audio Class 1.0 devices might fail to start or produce audio. Affected devices might experience one or more of the following symptoms:
- The device displays an error in Device Manager: “This device cannot start (Code 10).”
- No audio output.
- Volume controls are unresponsive or remain at zero.
- Sound settings are unresponsive or unavailable.
Some devices might function in standard stereo configurations but fail when using multichannel audio features, including 8-channel or 3D audio modes. Some customers have reported that they’re able to restore audio in these cases by switching to 2-channel mode. This issue is limited to USB Audio Class 1.0 devices.
Resolution: This issue is partially resolved in the out-of-band (OOB) update released on September 14, 2026. This OOB update resolves the symptoms experienced on devices using 8-channel or 3D audio modes. Microsoft is working to address the other symptoms and will provide more information when it is available. IT administrators who need an immediate workaround for the symptoms not addressed yet by the OOB update should contact Microsoft Support for Business for assistance.
“Windows Server Update Services (WSUS) does not display error details”
Affects: Windows Server 2022/2025 (KB5126646,KB5126655) https://support.microsoft.com/en-us/servicing/os/windows-server/2026/10/kb5126655-windows-server-2022-security-updatehttps://support.microsoft.com/en-us/servicing/os/windows-server/2026/10/kb5126646-windows-server-2025-security-update
Symptom: After installing KB5070881/KB5070884 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.
“Remote Desktop connections might fail for non-admin users with error 0xC000000D”
Affects: Windows 11 version 24H2/25H2/26H1/26H2 (KB5127648,KB5127646) https://support.microsoft.com/en-us/servicing/os/windows-11/2026/10/kb5127648-windows-11-24h2-25h2-26h2-security-update
Symptoms: After installing the September 2026 non-security preview update or later updates, non-admin users might be unable to establish Remote Desktop connections to remote devices that have Administrator protection enabled. Attempts to connect might fail with error 0xC000000D and display the message, “The token that was passed to the function is invalid.” This issue primarily affects enterprise-managed remote devices used as Remote Desktop hosts with Administrator protection enabled, regardless of how the feature was enabled.
Note: If your organization uses Windows security baselines, published through the Microsoft Security Compliance Toolkit, Administrator protection is enabled by default in Windows 11, version 24H2, 25H2, and 26H2 security baselines, unless your organization has configured the policy differently.
Resolution: IT administrators can mitigate this issue on devices affected by the Remote Desktop connection failure by using their existing policy management method to temporarily turn off Administrator protection. Reset the User Account Control Type Of Admin Approval Mode policy in Microsoft Intune or Group Policy. For more information, see Administrator protection on Windows 11.
Next steps: Microsoft is working to address this issue in a future Windows update and will provide more information when it is available.
“Exchange Server OWA to fail with an error MapiExceptionMdbOffline: Unable to make connection to the server”
Released: October 2026 Exchange Server Security Updates https://techcommunity.microsoft.com/blog/exchange/released-october-2026-exchange-server-security-updates/4563014
Update October 15, 2026: We have received reports indicating that installation of October 2026 updates for Windows Server – KB5126646 (Windows Server 2025), KB5126655 (Windows Server 2022), KB5126651 (Windows Server 2019) or KB5126868 (Windows Server 2016) – can cause Exchange Server OWA to fail with an error MapiExceptionMdbOffline: Unable to make connection to the server. (hr=0x80004005, ec=1142) with event ID 1006 logged in the Application Log, as well as growing email queues. Installation of October 2026 Exchange updates is not required for issues to occur. We are investigating this with our Windows partners.
Monthly Rollup/Security Only/Windows 10,11/Server 2016,2019,2022,2025 KBs
Links are https://support.microsoft.com/en-us/help/####### with the KB number only.
Security and Quality Rollup
- KB5126836 – Windows Server 2012 R2 (ESU)
- KB5126835 – Windows Server 2012 (ESU)
Cumulative Updates
Windows 10
- KB5126657 – Version 21H2 “November 2021 Update” (OS Build 19044) (ESU)
- KB5126657 – Version 22H2 “November 2022 Update” (OS Build 19045) (ESU)
(Versions 1507,1511,1607,1703,1709,1803,1809,1903,1909,2004,20H2,21H1 are no longer under support)
Windows 11
- KB5126653 – 23H2 (OS Build 22631)
- KB5127648 – 24H2 (OS Build 26100)
- KB5127648 – 25H2 (OS Build 26200)
- KB5124006 – 26H1 (OS Build 28000)
- KB5127648 – 26H2 (OS Build 26300)
(Version 21H2,22H2 are no longer under support)
Windows Server
- KB5126868 – Server 2016 (EOS January 2027)
- KB5126651 – Server 2019 (EOS January 2029)
- KB5126655 – Server 2022 (OS Build 20348)
- KB5126646 – Server 2025 (OS Build 26100)
October 2026 updates for Microsoft Office
Notable CVEs
CVE-2026-70571 | Microsoft Exchange Server Remote Code Execution Vulnerability (KB5128895,KB5128896,KB5128897,KB5128898)
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70571 Stack-based buffer overflow in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.
CVE-2026-92707 | MessagePack-CSharp Denial of Service Vulnerability (.NET Framework Cumulative Update/Monthly Rollup)
http://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-92707 Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally.
CVE-2026-96951 | Windows Shell Security Feature Bypass Vulnerability (Cumulative Update/Monthly Rollup)
https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-96951 Improper neutralization of special elements used in a command (‘command injection’) in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-108398 | .NET Framework Security Feature Bypass Vulnerability (.NET Framework Cumulative Update/Monthly Rollup)
https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-108398 Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally.
