Windows October 2026 Patch Tuesday: 70 critical flaws, patch Active Directory first

A release this large is not a reason to patch everything at once. It is a reason to decide the order before you start.

What was released

The October Windows Patch Tuesday contains about 1,411 CVEs, and 70 of them are rated Critical. The exact count changes slightly depending on how products are counted, so use Microsoft's Security Update Guide as the reference for your own systems.

The exploited flaw: CVE-2026-96951

CVE-2026-96951 is a Windows Shell vulnerability that bypasses Mark-of-the-Web, and it is being exploited. Mark-of-the-Web is the marker Windows adds to files that come from the internet, so that the system and Office can warn before opening them. A bypass means a file may open without that warning.

In practice, treat it as a phishing and download risk: it matters most on the machines where people open attachments and downloaded files. Patch those endpoints early, and remind people not to open files they did not expect. Windows is a repeat target this season: the Print Spooler bug returned with a new escalation path.

Patch these first

The Critical Active Directory Domain Services and AD FS flaws should be patched first on the servers that run them. Those servers decide who can sign in to everything else, so a flaw there reaches much further than one on a single workstation.

• Domain controllers (Active Directory Domain Services).
• AD FS servers, and any AD FS proxies facing the internet.
• Then internet-facing servers, then the rest of the servers, then endpoints in waves.

Patch domain controllers one at a time and check replication and sign-in between each one, so a problem never takes the whole directory down.

How to prioritise the rest

• Exploited flaws first, everywhere they apply.
• Critical flaws on exposed or identity systems next.
• Everything else in your normal patch cycle, using the vendor's severity and your own exposure to decide.

Verify the result

Updates are only done when they are installed and the machine has restarted. On a server, check what is installed and when:

Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10
Get-ComputerInfo | Select-Object OsName, OsBuildNumber

Check that your management tool reports the same, and chase the machines that did not restart.

The bottom line

Patch CVE-2026-96951 on the machines where people open files, patch Active Directory Domain Services and AD FS first on the servers that run them, and then work through the rest by exposure. Attackers do not wait for your cycle: a LockBit successor hit three European logistics firms in one week.