Microsoft patches over 1,400 Windows security flaws, including two zero-days
Microsoft's October Windows update patches over 1,400 security flaws, including two zero-days, one exploited, per ZDNet.
The update is Microsoft's first official one for Windows 11 26H2 and the last supported update for Windows 11 24H2 Home and Pro editions, ZDNet said. It covers all supported versions of Windows 11, including 26H2, 26H1, 25H2, and 24H2, as well as 23H2 Enterprise and Education, and Windows 10 PCs enrolled in Microsoft's Extended Security Updates program.
Citing patch management provider Action1, ZDNet reported that the update fixes 80 critical vulnerabilities and two zero-days. The exploited zero-day, designated CVE-2026-96951, involves a flaw in Windows Shell. Action1 said it could allow a remote attacker to bypass a Windows security defense by convincing users to open specially crafted files or interact with malicious content. That could weaken Windows protections and increase the risk of malicious content reaching users without the expected security warnings, according to the advisory.
The other zero-day, CVE-2026-108398, was publicly disclosed before the fix was released and could let an attacker bypass security measures through a flaw in Microsoft's .net Framework, ZDNet reported.
Beyond security patches, the update fixes glitches in File Explorer. The Preview pane makes it easier to preview downloaded files, File Explorer retains whether sections are expanded or collapsed, and thumbnail previews for cloud-based files in the Details pane render more reliably, according to ZDNet. The update also improves the accuracy and stability of connected Bluetooth devices and accessories. It adds a Windows 11 setting that lets users remap the Copilot key to act as the right Ctrl key or open the right-click context menu on the desktop and in File Explorer.
Because annual Windows versions lose support after 24 months, Windows 11 24H2 Home and Pro editions have reached the end of support, and users need to upgrade to the latest version to keep receiving security updates, ZDNet reported. Windows 11 23H2 Enterprise and Education editions reach end of support on November 10, and organizations will also need to update to stay protected. Users can check for the update through Settings and Windows Update; in Windows 11, they should see a notice that Windows 11, version 26H2 is available.