Windows update patches a whopping 1,400 security bugs – including 2 zero days

October’s Windows update is a broad security and feature-maintenance package. It fixes roughly 1,410 security vulnerabilities, including critical flaws and two zero-days. It also improves File Explorer, Bluetooth reliability, and the usefulness of the Copilot keyboard key. The update matters because unsupported Windows versions stop receiving security fixes.

The first official update goes to Windows 11 26H2. Supported Windows 11 editions include 26H2, 26H1, 25H2, and 24H2, while Windows 11 23H2 Enterprise and Education also receive it. Windows 10 computers enrolled in Microsoft’s Extended Security Updates program get the latest security patches. Users install it through Settings and Windows Update.

For Windows 11 24H2 Home and Pro, this is the final supported update. Those users must move to Windows 11 26H2 to continue receiving protection. Windows 11 23H2 Enterprise and Education reach their deadline on November 10, so organizations must plan that upgrade too.

The October update is unusually large. Microsoft’s total varies depending on which fixes are counted, but the figure hovers around 1,410 security vulnerabilities. Action1’s advisory identifies 80 critical vulnerabilities and two zero-days. That combination makes the update important for both ordinary users and organizations managing many Windows computers.

One zero-day is CVE-2026-96951, a Windows Shell flaw. It has already been exploited in the wild and could let a remote attacker bypass security protection. The other, CVE-2026-108398, affects Microsoft’s .NET Framework. It was publicly disclosed before Microsoft released the fix. Both vulnerabilities involve attackers getting around security measures.

Users should install the update through Windows Update and restart if prompted. Windows 10 computers receive these security patches only when enrolled in Microsoft’s Extended Security Updates program. Windows 11 24H2 Home and Pro users must also upgrade afterward because this update is their last supported one.

A zero-day vulnerability is a software weakness that becomes known or is exploited before a security fix is broadly available. The name reflects the lack of preparation time for defenders. Such flaws are dangerous because attackers may act before users and administrators can install a patch. The article identifies two zero-days in this Windows update.

The most urgent example is CVE-2026-96951, a Windows Shell vulnerability. Action1 says it has already been exploited in the wild. An attacker could use it remotely by persuading someone to open a specially crafted file or interact with malicious content. The flaw can bypass a Windows security protection intended to warn users about dangerous files.

That active exploitation raises the need to install the update quickly. The second zero-day, CVE-2026-108398, was publicly disclosed before the fix and affects Microsoft’s .NET Framework. Both cases show why prompt patching matters, especially when attackers know how to target the weakness.

The Windows Shell zero-day, CVE-2026-96951, can let a remote attacker bypass an important security protection. That protection is designed to help users recognize potentially dangerous files. Bypassing it matters because users may trust content that Windows would normally flag or warn about.

According to Action1, attackers can exploit the flaw by convincing people to open specially crafted files or interact with malicious content. If exploitation succeeds, malicious content could reach users without the expected security warnings. The weakness therefore targets both Windows’ defenses and the decisions people make when opening files or responding to content.

The article does not describe a specific attack outcome beyond weakened protections and increased risk. However, it confirms that the flaw has already been exploited in the wild. Microsoft’s October update fixes it, so installing the update and restarting when requested helps move the computer onto the patched version of Windows.

Microsoft supports each annual Windows version for 24 months. After that period, it provides no more security updates or bug fixes for that version. Windows 11 24H2 has reached this milestone for Home and Pro editions, so the October update is their last supported one. Windows 10 computers need Microsoft’s Extended Security Updates program to receive the latest patches described here.

Users on Windows 11 24H2 should open Settings, choose Windows Update, and look for the notice that Windows 11 version 26H2 is available. They can then download and install it. The article specifically says Windows 10 PCs enrolled in ESU receive the latest security patches; systems outside that program do not have that stated coverage.

Upgrading is therefore a security requirement, not just a feature choice. Remaining on an unsupported version means missing future fixes. Windows 11 23H2 Enterprise and Education users face a similar deadline on November 10 and must update to stay protected.

Security updates protect a computer by correcting weaknesses and strengthening defenses against attacks. In this update, Microsoft fixes flaws in Windows Shell and the .NET Framework, among many others. It also addresses bugs in features such as File Explorer and Bluetooth. Installing the patch reduces exposure to vulnerabilities that attackers might exploit.

A restart is often needed because Windows must activate updated system components. Some files and services are in use while the computer runs, so they cannot be completely replaced or reloaded immediately. During a reboot, Windows can finish applying the update and start the protected components again. The article notes that an update may already be installed while waiting for a reboot.

Restarting is therefore part of completing the installation, not an optional cosmetic step. Until the patched components load, the computer may still be running some older code. Users should check Windows Update, install the October update, and restart when Windows requests it.

A software vulnerability is a mistake or weakness in a program that creates an unintended security gap. The flaw might involve how code handles files, content, permissions, or user input. Attackers look for ways to make the program perform an action its designers did not intend. The October update fixes many such weaknesses in Windows and related components.

A security defense can be bypassed when a flawed check gives the wrong result. For example, Windows Shell might fail to recognize that specially crafted content is dangerous. An attacker could then persuade a user to open it, while Windows does not show the expected warning. The article describes this mechanism for CVE-2026-96951, which attackers have already exploited.

The result is not that every vulnerable computer is automatically compromised. It means the defense has been weakened and the chance of successful malicious activity rises. Patches correct the faulty code or its security logic. Installing them restores the intended protection and closes the known route.