October 2026 Patch Tuesday: what to update right now on Windows servers
On 13 October 2026 Microsoft fixed a record 1,413 vulnerabilities, including a Windows Shell flaw already being exploited. What to update first on your servers, why the risk is higher for SMEs, and a procedure for this week.
A record month: 1,413 vulnerabilities fixed in one go
On 13 October Microsoft released its monthly security update, known as Patch Tuesday, with an unprecedented number of fixes: 1,413 vulnerabilities across 176 updates. September had already set a record with 974 (Guru3D). According to Trend Micro's Zero Day Initiative, this is the first time a single month has exceeded a thousand fixes, more than Microsoft had ever released in an entire year.
Three figures show the scale of the problem for anyone managing servers (Splashtop):
- 1,102 vulnerabilities affect Windows, client and server;
- 78 are rated critical, and 65 of these allow remote code execution;
- 1 is already being exploited by attackers, and another was made public before the fix was available.
Microsoft attributes part of the increase to the use of artificial intelligence to find bugs. The same pattern is visible in other ecosystems, from WordPress to firewalls: finding vulnerabilities keeps getting cheaper, and the window for updating keeps getting shorter. This is not a problem with one product, but with all the software a business keeps running.
What to update first on your servers
With more than a thousand fixes, assessing them one by one is not an option: start with what is already under attack and with what, if compromised, opens the door to the whole network. The table summarises the priorities for a typical Windows Server environment, based on Splashtop's analysis.
| Priority | Component | Vulnerability | Why it matters |
|---|---|---|---|
| Immediately | Windows Shell (all machines, servers included) | CVE-2026-96951, already exploited | Bypasses "Mark of the Web": a file received by email opens without security warnings. Affects Windows Server 2012 R2 and later |
| Immediately | .NET Framework | CVE-2026-108398, already public | Lets someone already inside bypass the controls on which applications are allowed to run |
| Within 72 hours | DHCP Server | 5 critical remote code execution vulnerabilities | DHCP is reachable from the entire internal network: an ideal point from which to spread an attack |
| Within 72 hours | Active Directory, AD FS, NDES | Remote code execution and identity spoofing | Whoever compromises a domain controller controls the whole environment |
| Within 72 hours | Remote Desktop Gateway, QUIC (HTTP/3) | Remote code execution | These services are often exposed to the Internet |
| Within 72 hours | Exchange Server, SQL Server | Remote code execution on Exchange | They hold the company's email and data |
| Within 72 hours | Hyper-V | Remote code execution on the host | A compromised host puts every virtual machine it runs at risk |
| 1-2 weeks | Office (Excel above all), PostScript printer drivers, graphics components | Dozens of critical vulnerabilities | Triggered by opening a document or an image; more dangerous combined with the Windows Shell zero-day |
The two "special" vulnerabilities are rated only Important, not critical. The fact that attackers already know about them matters more than the severity label.
Why it is a bigger problem for SMEs
Large companies have dedicated tools and people for updates. In an SME there is often just one Windows server, doing many things at once, and nobody wants to reboot it during working hours. These are the four situations we come across most often.
- One server doing everything. Domain controller, DHCP, file server and business management software on the same machine. This is exactly the combination where this month's critical vulnerabilities are concentrated.
- Postponed reboots. Updates are downloaded but sit waiting for a reboot for weeks. Until the server restarts, the fix is not active.
- End-of-life versions. For Windows Server 2012 and 2012 R2, paid Extended Security Updates ended on 14 October 2026: this month's was the last one (Microsoft). Windows Server 2016 goes out of support on 13 January 2027 (Microsoft). At the current rate of discovery, a server without updates piles up new flaws every month.
- Services exposed without anyone knowing. Remote Desktop open to the Internet, management panels reachable from outside, ports opened "temporarily" years ago.
The risk is not theoretical. This month's zero-day works together with the Office vulnerabilities: a single attachment opened by a user is enough to reach a PC, and from there, through unpatched DHCP or Active Directory, the rest of the network.
What to do this week
An essential procedure for anyone with one or more Windows servers on premises or in the cloud.
- 01
Take an inventory
Which servers you have, which version of Windows Server they run, which roles they perform (domain, DHCP, file, business software, Exchange, Hyper-V) and which services are reachable from the Internet.
- 02
Take a verified backup before updating
A virtual machine snapshot or a full backup, with a restore test.
- 03
Install the October cumulative update now
on every machine, starting with exposed ones and with domain controllers, DHCP and Hyper-V. Then reboot: without a reboot the fix is not active.
- 04
Check that the update is actually installed
Through Windows Update or with a simple PowerShell command that lists the installed patches, on every server.
- 05
Close what should not be open
Never expose Remote Desktop directly to the Internet, only through a VPN or an up-to-date gateway; management panels reachable only from the internal network.
- 06
Plan your move off end-of-life versions
If you still run Windows Server 2012 or 2016, schedule the migration: it costs less to do it calmly than after an incident.
- 07
Make it a habit
A fixed maintenance window every month, right after the second Tuesday, with someone accountable for it.
How we work
At Cloudfactory we manage Windows servers for companies, professional firms and healthcare organisations, on premises and in the cloud, alongside Linux servers. Every month we follow the same routine: reading the Microsoft bulletin, setting priorities based on each server's roles, backup, updating in an agreed window, verification and a report to the client. When a machine reaches end of life, we say so in good time and prepare the migration.
If you are not sure whether your servers have received the October updates, get in touch: we will run a check and tell you what is missing.
How we wrote this article
At Cloudfactory we also use artificial intelligence in our editorial work: it helps us find and cross-check sources, compare data, set up the structure and polish the language. The system we use is configured by us, with instructions, examples and procedures built around the way we write. Our team checked every source, corrected the text and approved the published version. The assessments and choices are Cloudfactory's, and we take responsibility for them.
Frequently asked questions
What is Patch Tuesday?
It is the day Microsoft releases its monthly security updates: the second Tuesday of every month. In October 2026 it fell on the 13th.
Which October vulnerability is already being exploited?
CVE-2026-96951 in Windows Shell, which allows attackers to bypass security warnings on files downloaded from the Internet. It affects Windows 10, Windows 11 and Windows Server 2012 R2 and later.
Do I also need to update servers that are not exposed to the Internet?
Yes. This month's critical vulnerabilities in DHCP, Active Directory and Hyper-V are precisely what attackers use to spread from a single PC on the internal network.
Is installing the updates enough?
You also need to reboot: until the server restarts, the fix is not active. Then you should check that the installation succeeded.
How long is Windows Server 2016 supported?
Extended support ends on 13 January 2027. After that, the server will no longer receive security fixes. For Windows Server 2012 and 2012 R2, paid Extended Security Updates already ended on 14 October 2026.