October 2026 Patch Tuesday: The Exploited Windows Flaw, the 24H2 Cutoff and the Bugs Offices Are Hitting

On October 13, 2026, Microsoft shipped a record 1,411 fixes, including one for a Windows flaw (CVE-2026-96951) that attackers were already using to slip booby-trapped files past the warnings Windows shows for downloads and email attachments. The same update was the last security update Windows 11 version 24H2 Home and Pro will ever get. If you do one thing this week, confirm every PC and server has the October update, and move any 24H2 Home or Pro machine to version 26H2 so it keeps getting fixes.

It hasn't been a smooth month. Some users reported the update failing with error 0x800f0845. Some offices found that staff could no longer connect through Remote Desktop. And a lot of Pro PCs are still sitting on 24H2, quietly out of support, because the upgrade only installs itself on some machines. Below is what people actually ran into, why it matters, the numbers behind the urgency, a 10-minute self-check, and the fixes in the order we'd do them.

What offices actually ran into after October 13

The first thing admins noticed was the size. October's release fixed 1,411 vulnerabilities, 70 of them rated Critical, not counting 348 more Microsoft fixed earlier in the month in separate releases (BleepingComputer (opens in a new tab)). Dustin Childs, who leads threat awareness at the Zero Day Initiative, summed up the mood: "The volume isn't the real story anymore" (Help Net Security (opens in a new tab)). For a small office, he's right. The story is the one flaw being used in attacks and the version of Windows that just lost support.

The update that wouldn't install

Within days, some users reported that the October cumulative update for Windows 11, KB5127648, failed to install with error 0x800f0845, which shows up in Settings under Windows Update, then Update history, as a failed install. Others reported 0x80070306 or 0x800f0989 (a roundup of the reports (opens in a new tab)). These are individual reports, not a confirmed bug: Microsoft's KB5127648 page (opens in a new tab) doesn't list any install error as a known issue. In plain terms: if a PC fails, there's no official fix to wait for, and the machine stays unpatched against an exploited flaw until someone notices.

Remote Desktop, Smart App Control and USB audio

Microsoft did confirm three problems on its own KB5127648 support page (opens in a new tab). Non-admin users connecting to computers with Administrator protection turned on could be refused with error 0xC000000D and the message "The token that was passed to the function is invalid." Microsoft traced that one back to the September 22 preview update. A second issue meant "some devices might be unable to turn on Smart App Control" if it had been switched off before, with the option grayed out. A third left some USB audio devices showing Code 10 in Device Manager or producing no sound, which is exactly the kind of thing that makes a front desk headset stop working on a Monday morning.

Here's the detail that matters most. Microsoft fixed the Remote Desktop and Smart App Control problems in an update released on or after October 27 (KB5127936), but only for Windows 11 25H2 and 26H2. PCs on 24H2 get a registry or Group Policy workaround instead. That is what the end of support looks like in practice: the bug gets fixed for everyone else, and your 24H2 machines keep it.

PCs stuck on 24H2 without anyone knowing

The quietest problem is the most common one. Microsoft is rolling out Windows 11 26H2 in phases, and only PCs with the 'Get the latest updates as soon as they're available' setting switched on install it automatically, according to BleepingComputer (opens in a new tab). Every other Pro PC stays on 24H2. It still boots, opens Outlook and prints. There's no red warning on the screen. It just stopped getting security fixes on October 13.

The exploited flaw: how a Mark of the Web bypass gets past your staff

When a file arrives from the internet, through a browser download or an email attachment, Windows tags it with something called the Mark of the Web. That tag is what tells Office to block macros in a downloaded spreadsheet and what drives the other 'this file came from the internet' protections (Microsoft (opens in a new tab)). It's one of the few safety nets that still works when someone clicks something they shouldn't.

CVE-2026-96951 lets an attacker evade that safety net. Microsoft's advisory (opens in a new tab) describes the attack: a specially crafted file sent by email or instant message, or a link to a site the attacker controls. Microsoft notes "an attacker would have no way to force a user to view attacker-controlled content," so the attacker has to talk someone into opening it. That's not much comfort. Convincing a busy paralegal, billing clerk or office manager to open an invoice is what phishing does all day. Microsoft rates the flaw 8.8 out of 10 and marked it as exploited before the patch existed.

This is not a one-off. Satnam Narang, senior staff research engineer at Tenable, pointed out: "This is the third flaw in Windows Shell that was exploited in the wild this year" (Help Net Security (opens in a new tab)). The first, CVE-2026-21510, was linked to APT28, the Russian group also known as Fancy Bear. Narang added that it's unclear whether this new one is linked to the same group. Either way, the technique works, and once a method works, ordinary criminal groups copy it.

CISA added the flaw to its Known Exploited Vulnerabilities catalog (opens in a new tab) the same day, October 13, and gave federal agencies until October 16 to fix it. Three days. That's the deadline the federal government set for itself, and it's a reasonable one for a 20-person office too.

Two more fixes worth knowing about

If your office has its own Windows server running Active Directory (the server that handles everyone's logins), note CVE-2026-70229, a Critical flaw in Active Directory Domain Services. Microsoft says (opens in a new tab) an attacker with no password could send a specially crafted packet to run code on the server. It needs specific conditions to work and isn't known to be exploited yet, but Microsoft rates exploitation as "more likely."

A third flaw, in .NET Framework (CVE-2026-108398), was made public before the fix. The October updates fix all three. On Windows 11, the .NET fix arrives as its own .NET Framework update in Windows Update, so make sure that one installs too.

Why waiting a month is no longer safe

The old habit of patching 'sometime this month' was built for a world where attackers needed weeks to weaponize a bug. That world is gone. Google's Mandiant reported in March 2026 that the mean time to exploit dropped to an estimated minus 7 days, meaning attackers are routinely exploiting flaws before a patch is even released, and that exploits were the most common way into networks for the sixth year running, at 32% of intrusions (Google Cloud, M-Trends 2026 (opens in a new tab)).

Verizon's 2026 Data Breach Investigations Report found the same thing from the other side. Exploiting vulnerabilities was how 31% of breaches started, and only 26% of the critical flaws on CISA's exploited list were fully fixed, down from 38% the year before, with a median of 43 days to finish the job (Help Net Security (opens in a new tab)). Meanwhile, CISA's catalog grew to 1,764 entries as of October 29, 2026, with 280 added so far this year, already more than the 245 added in all of 2025. Forty of this year's additions are Microsoft products.

Childs' advice for October fits on a sticky note: "Patch what's proven, prioritized, and public, and treat everything else as this month's new normal." For a small office, CVE-2026-96951 is proven, prioritized and public.

Windows 11 24H2 Home and Pro are now out of support

Microsoft put it plainly, as quoted by BleepingComputer (opens in a new tab): "The October 2026 monthly security update is the last update available for these editions." Starting with the next Patch Tuesday on November 10, a Pro PC still on 24H2 gets nothing, including the fix for the next exploited flaw.

This catches people because the same version number has different end dates depending on the edition. Windows 11 24H2 Enterprise and Education stay supported until October 2027, so plenty of advice online says 24H2 is fine. For Pro, which is what many small offices run, it isn't.

Dates come from Microsoft's lifecycle pages for Windows 11 Home and Pro (opens in a new tab) and Windows 11 Enterprise and Education (opens in a new tab).

Windows 10 hasn't gone away either

In September 2026, Windows 10 still accounted for 18.93% of desktop Windows web traffic in the United States, according to StatCounter (opens in a new tab). That's almost one in five, a year after support ended. A Windows 10 PC only gets the October fix (KB5126657) if it's enrolled in Extended Security Updates, which Microsoft sells to businesses (opens in a new tab) at $61 per device for the first year, doubling each year, for up to three years. If it isn't enrolled, it's missing this fix and every fix since October 2025. Our Windows 10 end of support guide walks through the replace-or-extend decision.

On the server side, Windows Server 2016 security updates end in January 2027. If you still have one in the closet, see our Windows Server 2016 end of life guide now, not in December.

Your 10-minute self-check: winver, update history and build numbers

You don't need special software to know where you stand. Pick three or four PCs, including the oldest one and a laptop that travels, and give each one about two minutes.

Minute one: version and edition. Press the Windows key, type winver and press Enter. The window shows the version (24H2, 25H2 or 26H2) and the OS build number. Then open Settings, then System, then About, and look at the edition line: Home, Pro or Enterprise. Pro plus 24H2 means that PC is out of support today.

Minute two: did October actually install? Open Settings, then Windows Update, then Update history. Look for the 2026-10 cumulative update (KB5127648 on most Windows 11 PCs). If it says it failed, note the error code. If the October update only shows as failed, with 0x800f0845 or any other code, the PC is not protected against the exploited flaw.

Minute three: compare the build. Check the build number from winver against this table, taken from Microsoft's October 2026 update data for CVE-2026-96951. A build at or above the number listed has the fix.

Last few minutes: score the bigger picture. Take our free security score. It's 12 yes or no questions, and one of them asks whether security updates for computers, servers and firewalls are installed within 14 days of release. If you had to answer 'not sure' to that one after this check, you've found your first fix.

The fixes, in the order we'd do them this week

1. Servers first, domain controllers before everything else. Because of the Active Directory flaw, install the October update on any server that runs Active Directory first, restart it in a quiet window, and confirm the build against the table. Then do your other servers. Servers are the machines nobody restarts, which is why they're often the ones still waiting.

2. Get every PC onto the October build. For PCs that already show the update as installed, make sure they've restarted since. For PCs that failed with 0x800f0845 or another code, Microsoft hasn't published a fix for those errors, so the usual first steps apply: restart, run the Windows Update troubleshooter, and try again. If it keeps failing, the standard next step is an in-place repair of Windows, which keeps files and apps; schedule that after hours. Microsoft's support page also notes that if you install the update manually from the Microsoft Update Catalog, a required checkpoint update (KB5043080) has to go on first.

3. Move 24H2 Home and Pro PCs to 26H2. Version 26H2 installs as a small enablement package (KB5121794) on top of 24H2 or 25H2 and needs one restart. Microsoft's instructions (opens in a new tab) list two requirements: the PC must be on 24H2 or 25H2, and it must have the September 22, 2026 preview update (KB5124010) or any later cumulative update. Go to Settings, then Windows Update, and if you see 'Windows 11, version 26H2 is available,' choose Download and install. If your office uses WSUS, approve the feature update named 'Windows 11, version 26H2' under the Upgrades classification. Once a PC is on 26H2, the October 27 update also fixes the Remote Desktop and Smart App Control problems, so you don't need the workarounds. PCs on older versions can't use the small package and need a full feature update.

4. If Remote Desktop broke, use Microsoft's workaround, then upgrade. On PCs you can't move off 24H2 yet, Microsoft's workaround for the 0xC000000D error is to temporarily turn off Administrator protection through the 'User Account Control Type Of Admin Approval Mode' policy in Intune or Group Policy. Treat that as temporary, because the real fix is getting to 26H2.

5. Decide on every Windows 10 PC. Either enroll it in Extended Security Updates this week or put it on the replacement list with a date. A Windows 10 PC that is neither is the easiest machine in your office to break into.

6. Tell your team what this attack looks like. The exploited flaw needs someone to open a file or click a link. Send a two-line note: don't open unexpected attachments, even from names you know, and never right-click a downloaded file and tick 'Unblock' in its Properties, because that removes the Mark of the Web on purpose. If your Office licenses are Microsoft 365 Apps for enterprise, turn on the 'Block macros from running in Office files from the Internet' policy. Microsoft notes (opens in a new tab) that this policy isn't available for Microsoft 365 Apps for business. Our free phishing quiz is a quick staff refresher.

7. Put November 10 on the calendar. That's the next Patch Tuesday and the day Windows 11 23H2 Enterprise and Education stop getting updates. For a monthly routine that keeps this from piling up, see our patch management guide.

How GlobeVM helps Los Angeles offices stay patched

Months like this one are where small offices fall behind: one exploited flaw, one version cutoff, a few PCs that won't take the update and a Remote Desktop problem that eats an afternoon. GlobeVM has been in business for more than 30 years, and when you call, you reach George or Nazy directly, not a ticket queue or an overseas call center. Firewall management, endpoint protection, email filtering and MFA come standard in every plan, which matters here because this attack starts with an email or a message. Our response time is 15 minutes, around the clock.

You can read how our remote monitoring and management service works, or how we support offices across Los Angeles. If you'd like a second set of eyes on where your PCs and servers stand after this month, book a free IT assessment.