October 2026 Patch Tuesday: What Small Businesses Should Patch Now
What did Microsoft fix in the October 2026 Patch Tuesday?
Microsoft’s October 2026 Patch Tuesday, released on October 13, 2026, fixes 1409 vulnerabilities in its own products, 69 of them rated critical, and 1 that attackers were already exploiting before the fix. Every Windows PC and Microsoft Office install should get this month’s updates within a few days, and any already-exploited flaw should be treated as urgent.
Patch Tuesday is the second Tuesday of each month, when Microsoft releases its scheduled security updates. Attackers study the fixes to work out the holes they close, so the days after release are when unpatched computers are most at risk. Microsoft’s full list is in its Security Update Guide.
Which vulnerabilities were already being exploited?
These are the ones to care about first. Microsoft confirmed attacks using them before the update was available:
- Windows Shell Security Feature Bypass Vulnerability (CVE-2026-96951)
Microsoft also listed 1 flaw as publicly disclosed before the fix, which means details were out in the open: .NET Framework Security Feature Bypass Vulnerability (CVE-2026-108398).
Which Microsoft products are affected this month?
The most-patched components this month were Microsoft Office Excel (69), Role: DNS Server (52), Windows Kernel (46), Windows Installer (38), Windows Win32 Kernel Subsystem (36), Microsoft Office SharePoint (36). Office users should note fixes in Microsoft Office Excel, Microsoft Office SharePoint, Microsoft Office Word, Microsoft Office Access; a malicious document is still one of the most common ways attacks start, so Office updates matter as much as Windows ones.
For most offices that means three things: Windows Update on every PC, Microsoft 365 or Office updates (they usually install themselves, but check that they have), and any on-premises server such as SQL Server or a file server.
What did CISA add to its exploited vulnerabilities list this week?
CISA’s Known Exploited Vulnerabilities catalog lists flaws with confirmed attacks in the wild. These are the additions from the past seven days in products a small business is likely to run:
| Product | Flaw | Added |
|---|---|---|
| ONLYOFFICE Docs | ONLYOFFICE Docs Server Path Traversal Vulnerability (CVE-2021-3199). | 2026-10-08 |
| Ivanti Connect Secure | Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability (CVE-2026-104935). | 2026-10-13 |
| Microsoft Windows | Microsoft Windows Command Injection Vulnerability (CVE-2026-96951). | 2026-10-13 |
Does this affect my business?
- Firewalls and VPN appliances: If your office firewall or remote-access VPN is one of these brands, it is the most urgent item here: these devices face the internet, and attackers scan for unpatched ones within days. Check the firmware version, not just whether the device is working.
- Windows and Microsoft 365: Every Windows PC needs this month’s updates. Check that they actually installed: a PC that has not restarted in weeks usually has not finished updating.
- Office and PDF software: Update Office, Adobe Reader and similar tools, and remind staff to be wary of unexpected attachments this week.
Which Microsoft deadlines are coming up?
- Windows 11 24H2 and Office 2021, this Patch Tuesday. This month’s updates are the last either one gets. Office 2021 bought outright (Home and Business, Professional) gets no more fixes, so any flaw found in it from now on stays open. Windows needs the free update to 25H2: how to check and update.
- OneDrive and SharePoint sharing, mid-October to the end of November. Outside people opening older links you shared with them will get “access denied” until they have a guest account. The one-step fix.
- Copier scan to email, end of December. Microsoft 365 switches off the password sign-in most copiers use to send scans. How to check your copier and four fixes.
What should a small business do this week?
- Confirm updates installed on every PC, including laptops that are rarely in the office.
- Restart computers and browsers so pending updates finish.
- Check your firewall and VPN firmware against the vendor’s latest version.
- Make sure multi-factor authentication is on for email and remote access, so a single exploited flaw or stolen password is not enough.
- Know when your backup was last restored from, not just whether it ran.
For the businesses we manage, this is handled centrally: updates are pushed and verified overnight. More on how that works: managed endpoint protection and patching, network security, the Windows 11 24H2 end-of-support deadline.
Catch up with all weekly security alerts.
Want This Handled for You?
iTech Plus provides managed IT and cybersecurity for small businesses and medical practices across Polk County, including Lakeland, Winter Haven, Davenport and Haines City. If you are not sure your computers and firewall are patched, we offer a free IT assessment with a written report. Call (321) 221-7117 or email info@itechplus.co.
