Last updated: October 14, 2026

The quick answer

Yes, install this month’s Windows update now. Microsoft’s October 2026 Patch Tuesday, released October 13, fixes a Windows Shell flaw that attackers were already exploiting to slip malicious files past Windows’ download warnings. On Windows 11 it arrives as KB5127648 or KB5126653, on Windows 10 (ESU) as KB5126657, and it is the final update for Windows 11 version 24H2 Home and Pro.

What happened

Microsoft’s monthly security release is the largest on record. Security firms count it slightly differently: Tenable tallies 1,407 CVEs, while BleepingComputer counts 1,411 flaws released on Patch Tuesday itself. Around 70 are rated Critical, though most of those affect servers and business software such as Exchange and Active Directory rather than home PCs.

Three of the fixes are zero-days, meaning they were exploited or publicly known before a patch existed:

CVE	Component	Status	What it allows
CVE-2026-96951	Windows Shell	Exploited in attacks	Bypassing Mark of the Web, the label that triggers warnings on downloaded files
CVE-2026-108398	.NET Framework	Publicly disclosed	Bypassing Windows Defender Application Control in managed environments
CVE-2026-92707	MessagePack-CSharp (.NET)	Publicly disclosed	Denial of service through excessive memory use

The one that matters most for everyday users is CVE-2026-96951. Mark of the Web is what makes Windows and Office treat a file from the internet or an email attachment with suspicion. According to Tenable, abuse of this flaw typically starts with a malicious file sent by email or message, so the user still has to be tricked into opening it. Tenable notes it is the third Windows Shell flaw exploited in the wild this year.

What changes for you

Beyond the security fixes, the Windows 11 update brings visible changes, according to BleepingComputer and Windows Latest:

• File Explorer: PDFs preview automatically again, while HTML files from the web show a “Preview anyway” button.
• Copilot key: can be remapped, for example to Right Ctrl or the context menu.
• Accessibility and input: a new “Open apps maximized” option, single-finger touchpad scrolling and Emoji 17.0.
• Fixes: File History backups to external and network drives work again, and several Bluetooth audio problems are resolved.
• Removed: PC-to-PC Migration in Windows Backup is no longer available.

Some features roll out gradually, so you may not see all of them immediately. Microsoft says it is not aware of new issues, but a problem with some USB Audio Class 1.0 devices, introduced by September’s updates, is still being worked on.

How to install the October update

1. Open Windows Update: on Windows 11, Settings > Windows Update; on Windows 10, Settings > Update & Security > Windows Update.
2. Select Check for updates and install everything offered, then restart. The update is mandatory, so it will install on its own eventually, but restarting now closes the exploited hole sooner.
3. Confirm the build: press Windows + R, type winver and press Enter. Windows Latest lists builds ending in .9711 for Windows 11 (26100, 26200 or 26300), and BleepingComputer lists 19045.7807 for Windows 10.
4. On 24H2 Home or Pro? Install this update, then move to version 26H2 from Windows Update. Microsoft says October is the last update for those editions.
5. Stay alert with attachments: even after patching, don’t open unexpected files from email or chat apps, especially archives and shortcuts.

For the upgrade itself, see what’s new in the Windows 11 2026 Update (26H2). Our roundup of Microsoft’s October 2026 deadlines covers the other products that lost support this week.

Who this affects and who it doesn’t

• Affected: every supported Windows 11 PC, and Windows 10 PCs enrolled in Extended Security Updates.
• Most urgent: people on Windows 11 24H2 Home or Pro, who get no more security fixes after this one unless they upgrade.
• Left out: Windows 10 PCs that never enrolled in ESU. Check yours with our guide to Windows 10 security updates through October 2027.
• Mostly IT teams: the Exchange, Active Directory and DNS Server fixes.

FAQ

Is it safe to install right away?

For most people, yes. Microsoft reports no new known issues, and an exploited flaw is a stronger risk than a rare update bug. If you rely on an older USB audio device, check it after restarting.

Why are there two Windows 11 KB numbers?

Microsoft released two cumulative updates, KB5127648 and KB5126653, for the supported Windows 11 versions. You don’t need to pick one: Windows Update offers whichever your PC needs.

Do I need antivirus on top of this?

Windows Security is built in and turned on by default. Updates close the hole; careful handling of attachments covers the social engineering that this attack depends on.

Sources

• Tenable: Microsoft’s October 2026 Patch Tuesday addresses 1,407 CVEs
• BleepingComputer: Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days
• BleepingComputer: Windows 11 KB5127648 & KB5126653 cumulative updates released
• BleepingComputer: Microsoft releases Windows 10 KB5126657 extended security update
• Windows Latest: Windows 11 October 2026 Update, everything new and fixed
• Windows Report: October 2026 Patch Tuesday tackles 1,411 flaws