Back to Blog

October 13 Was Windows 10’s Last Security Update. Microsoft Also Dropped 1,411 Fixes That Day.

October 13 was a bad week to be running Windows 10.

Two things happened at once. Microsoft’s October 2026 Patch Tuesday dropped—1,411 fixes, a new monthly record, beating September’s record of 974 by nearly 500.[1] And Windows 10 Extended Support officially expired, meaning those machines stopped receiving security patches for good.[2]

The timing is coincidental but the effect is real. If you have Windows 10 machines in your business, they didn’t get the week’s fixes. They won’t get next month’s either.

Quick background on where Windows 10 stands

Microsoft ended mainstream support for Windows 10 in October 2025. At that point, businesses could pay for Extended Security Updates (ESU), which bought continued patches at roughly $61 per machine in year one, doubling each subsequent year. That program just ran its course. There is no year three.

So depending on where your business falls: if you were on ESU, you got one final patch cycle and now you’re done. If you weren’t on ESU, your machines have been unpatched since October 2025. Either way, going forward, the vulnerability count on those machines grows with every new Patch Tuesday.

The zero-day that’s already being used

Of the 1,411 fixes, three are for vulnerabilities that were publicly known before the patch came out. One was already being actively exploited in the wild when Microsoft released the fix.[3]

CVE-2026-96951 is a Windows Shell security feature bypass with a CVSS score of 8.8. It’s been added to CISA’s Known Exploited Vulnerabilities catalog, which is basically the official signal that real attackers are using this right now, not just security researchers testing it in a lab.[3]

What it actually does: Windows has a feature called Mark of the Web (MOTW). When you download a file from the internet, Windows tags it. That tag is what triggers the yellow warning bar in Office (“PROTECTED VIEW — Be careful...”), the “Are you sure?” dialog before running an executable, and other friction points. This vulnerability bypasses that tag. A crafted file, delivered by email or through a malicious download link, opens like a trusted local file. No warning. No protected view. Just the payload.

It’s not a remote code execution flaw on its own, but it removes the safety layer that stops a lot of other attacks from working. A researcher at Tenable noted this is the third Windows Shell exploit used in the wild this year.[4] Someone is working through this class of vulnerabilities systematically.

What the rest of the month’s fixes look like

The other two publicly disclosed zero-days are CVE-2026-108398, a .NET Framework security bypass, and CVE-2026-92707, a denial-of-service in the MessagePack-CSharp library. Neither has hit the KEV catalog yet, but publicly disclosed vulnerabilities tend to get weaponized quickly after a patch ships. Attackers reverse-engineer the fix to find the flaw. The window between “patch released” and “exploit available” has been shrinking for years.

The highest CVSS scores in this month’s batch (10.0 and 9.9) belong to cloud services Microsoft patched on their end with no customer action required. For everything else, the update needs to actually run on your machines.

Options for Windows 10 machines

There are three real paths forward, and none of them are “do nothing.”

The first is upgrading to Windows 11. If a machine is under roughly five years old and meets the TPM 2.0 hardware requirement, the upgrade is free. Microsoft’s PC Health Check tool will tell you in about two minutes whether a machine qualifies. For most businesses with reasonably recent hardware, this is the straightforward answer.

The second is replacing machines that can’t upgrade. An older PC that doesn’t meet Windows 11’s requirements isn’t going to get there with a software fix. A new business desktop runs $600 to $900. If that machine handles email, billing, or any customer data, the math on running it exposed doesn’t take long to work out.

The third option, for equipment that genuinely can’t move to a supported OS because a vendor hasn’t updated their software (this comes up often in manufacturing and healthcare), is to isolate it. Segment it off the main network, restrict what it can reach, and make sure it isn’t the machine your staff use for browsing or email. It’s not ideal, but it limits the blast radius.

If you’re running managed endpoints through a patching tool, Windows Update should be handling most of this automatically for your Windows 11 machines. The gap tends to be the perimeter equipment, anything with auto-updates disabled, and the machines still sitting on Windows 10.