A record Patch Tuesday, and an October Windows update that can break Wi-Fi and VPN sign-in
Microsoft fixed 1,411 vulnerabilities on 13 October, including one already being exploited. Separately, the same month's update now blocks an old sign-in method some networks still rely on.
Infosecurity Magazine reports that Microsoft's October 2026 Patch Tuesday, released on 13 October, fixed 1,411 CVEs. That is an all-time record, ahead of the July and September releases this year. Microsoft attributes the rise to its use of AI to find and fix vulnerabilities.
What is actually urgent
Seventy of the fixes are rated critical, and 57 of those are remote code execution flaws. The one to prioritise is CVE-2026-96951, a Windows Shell security feature bypass rated 8.8, which is already being exploited. It needs no login or special privileges, only that someone opens a crafted file, for example one that arrives in a phishing email or from a malicious website. Two flaws were publicly disclosed before the fix, including CVE-2026-108398, a .NET Framework bypass of Windows Defender Application Control, with no workaround. Infosecurity Magazine also flags CVE-2026-70242, an Outlook Reading Pane remote code execution flaw rated 9.8, which a crafted email can trigger without the recipient opening or clicking anything.
The catch: NTLMv1 is now blocked
The Register reported on 16 October that this month's Windows update may break networking, including Wi-Fi, Ethernet and VPN authentication, for organisations that still use NTLMv1 derived credentials for single sign-on. Before the update Windows allowed them and logged a warning. Afterwards the requests are blocked. The behaviour is controlled by a registry value called BlockNtlmSSO. When it is not set, Windows now defaults to Enforce rather than Audit. The block does not apply where Credential Guard is enabled. Microsoft says this is by design, not a bug.
The workaround and why not to rely on it
Administrators can set BlockNtlmSSO to 0 to return to audit mode. Microsoft describes that as a scoped, temporary security exception, because it reduces protection. The Register notes that NTLM has been on Microsoft's deprecated list since 2024, and that connections based on MS-CHAPv2, such as PEAP-MSCHAPv2 and EAP-MSCHAPv2 in domain joined environments, can still depend on it.
What this means for your business
Install the October updates, starting with the PCs and laptops that handle the most email and web browsing, and do not leave it to the end of the month. Test on one or two machines first if you run Wi-Fi or VPN that signs in with domain credentials. If staff report that they cannot connect since the update, tell your IT provider about the NTLM change straight away. The temporary registry exception will get people working again, but the lasting fix is to move the network off the old sign-in method, with a date to do it. If you are in Exeter or the South West and want a hand, we can check it for you.
#WEARECOBALT
Ready when you are.
Tell us what's slowing your business down. We'll tell you exactly how we'd fix it — plainly, with no obligation.