Thank You for Patching: End-user apps

October 2026 Patch Tuesday: 1,413 fixes, one exploited zero-day, and an Exchange hangover

Sat, 24 Oct 2026 00:00:00 GMT

Call: Patch now. The Windows cumulative updates fix CVE-2026-96951, a Windows Shell Mark-of-the-Web bypass that is being exploited. CISA added it to KEV with a due date of October 16. Install it. Then work through the side effects below by role instead of holding the whole estate.

The numbers

Microsoft fixed 1,413 CVEs this month (SecurityWeek, CyberScoop, Malwarebytes). BleepingComputer counts 1,411 because it only includes the Patch Tuesday releases themselves. Either way it’s a record. CyberScoop says it beats Microsoft’s previous full-year record of 1,261, set in 2020, and SecurityWeek says it’s more than all of 2025 combined. One month. BleepingComputer counts 70 critical.

Exploited: CVE-2026-96951 (Windows Shell MotW bypass).
Publicly disclosed: CVE-2026-108398 (.NET Framework WDAC bypass) and CVE-2026-92707 (MessagePack-CSharp DoS).
KBs: KB5127648 (Win11 24H2/25H2/26H2), KB5126653 (Win11 23H2), KB5126657 (Win10 21H2/22H2), KB5126646 (WS2025), KB5126655 (WS2022), KB5126651 (WS2019), KB5126868 (WS2016).

What breaks

On-prem Exchange (Deploy with care, confirmed by Microsoft). The October Windows Server updates (KB5126651, KB5126868, KB5126655, KB5126646) cap Endpoint Mapper lookups. On busy Exchange 2016/2019/SE servers, the default 512 RPC contexts fill in about a day. Then OWA throws MapiExceptionMdbOffline, queues fill with 432 4.3.2, and mail sits in Outbox. Microsoft says don’t uninstall. Set EpmapSavedContextCap to 65536 under HKLM\SOFTWARE\Microsoft\Rpc and restart; you can set it before you install. No fix is imminent. (Exchange team blog, r/sysadmin)

PEAP-MSCHAPv2 SSO (Deploy with care). NTLMv1 SSO blocking is now enforced by default on Win11 24H2+ and WS2025 when Credential Guard is off. Only “use my Windows logon” pass-through breaks; typed credentials and machine-certificate auth are fine. About 4 independent megathread commenters plus two threads hit it. Microsoft calls it planned. Use BlockNtlmv1SSO=0 as a dated exception (event 4024 = audit, 4025 = block), and plan EAP-TLS. (KB5127648, MS Q&A)

Boot failures (Deploy with care, reported, not confirmed). There are 6 independent first-hand reports of KB5127648 failing at the finalizing reboot: 0xc000000d, winload.efi errors, or BitLocker recovery. They’re mostly Dell, plus Dynabook Tecra A60-M. One fleet of about 5,000 lost “a few.” Pilot by model and update firmware first. The workaround is DISM /revertpendingactions plus bcdboot from WinRE. (r/sysadmin, Tech Community)

Smaller items:

Smart App Control can’t be turned back on after KB5127648. There’s a registry workaround.
Non-admin RDP fails with 0xC000000D on hosts with Administrator protection.
Always On VPN automatic protocol selection is still broken. Microsoft marked it resolved, then reverted that on Oct 19.
Born reports install errors 0x800f0845/0x80070306/0x800f0989, and more than 70 Xbox Live 0x87DD0005 complaints. Neither is confirmed.

The rumor check

We were told October “broke security software and Classic Outlook.” Here, “security software” means physical security: Lenel, Genetec and similar. Here’s what the sources support:

Record count: true. See above.
Physical security software: not confirmed for October as such. There is one real thread, and it’s older.
- About 5 independent Reddit reports say older LenelS2 OnGuard (8.1 and earlier) loses its Login Driver/database connection after the August 11, 2026 cumulative updates, and every CU since, October included.
- LenelS2 hasn’t posted anything official. One second-hand TSG statement says only 8.0 and below are affected, but two posters say 8.1 is too.
- Call: hold those hosts only, isolate them (the CU fixes an exploited zero-day), and upgrade OnGuard.
- I found nothing for Genetec, Milestone, C•CURE 9000, Avigilon or Pro-Watch.
Classic Outlook: not as stated. Classic Outlook has open Microsoft-documented problems: stale shared-mailbox search, a shared-calendar crash, and Kaspersky crashes. None of them come from the Windows update. If your Outlook clients are stuck in Outbox, look at your Exchange servers first.

Housekeeping

AskWoody is at MS-DEFCON 2 (defer until at least Oct 27).
Windows Server 2022 left mainstream support on Oct 13.
Canadian time zone updates land before Nov 1.

Full tracker: Patch Watch.

HP ProBook 4 G1i BIOS 01.05.04: restart is now a two-step process

Sat, 24 Oct 2026 00:00:00 GMT

Call: Hold BIOS X72 01.05.04 (SP174391) on HP ProBook 4 G1i. This is reported, not confirmed: 5 reports in one HP Community thread between Oct 10 and 19. An HP employee replied with generic troubleshooting steps, but HP hasn’t confirmed a bug or published a fixed BIOS.

What breaks: Any restart started by the OS hangs before the HP logo. You get a black screen, the power LED stays on and Caps Lock does nothing, so you have to force the power off. It happens in Windows, WinPE and an Ubuntu live USB. A full shutdown followed by power-on works, and so does a restart from F10 setup. One user traced it to the ACPI FADT reset path.

Who’s hit: Fleets with HP BIOS auto-update turned on. One buyer of 5 units reported the update breaking them.

Do: Turn off automatic BIOS updates and block SP174391 in your HP tooling. On affected units, shut down instead of restarting. Rolling back to 01.04.03 works, but the laptop updates itself straight back to 01.05.04, and one downgrade failed with an Intel ME error. On Linux, one user reports reboot=efi (or reboot=pci) works.

Sources: HP Community thread.

NVIDIA 621.01: your videos now come with intermissions

Sat, 24 Oct 2026 00:00:00 GMT

Call: Hold on GeForce 621.01 (Oct 21, the first R620 driver) unless you need its new game support. On Oct 23, NVIDIA staff on its forum logged the bug and asked for crash dumps. There’s no fix date. The release notes list no open issues.

What breaks: Video in Chrome, Edge and VLC freezes for a few seconds, or the screen goes black and comes back. Starting a game while a browser video plays can trigger it. Look for nvlddmkm Event ID 153 starting Oct 21, sometimes with LiveKernelEvent 141 or 117.

Who’s hit: Mostly RTX 5080 owners, some RTX 4090, and a lot of multi-monitor and 480Hz setups.

Workaround: Roll back to 617.42 (Oct 6), ideally with DDU for a clean install. The cost: you lose 621.01’s Game Ready support for Phantom Blade Zero (Oct 28) and Crimson Desert Enhanced (Oct 29). If you’re on 480Hz, users report that dropping to 360Hz stops the dropouts on 621.01.

I haven’t read NVIDIA’s forum thread directly. The acknowledgment comes from the three write-ups below.

Sources: BottleneckPC, Joho no Todai, VGTimes.

KB5127648 boot failures: reported, not confirmed, worth a pilot ring per model

Sat, 24 Oct 2026 00:00:00 GMT

Call: Deploy with care. This is reported, not confirmed. I count 6 independent first-hand reports, and Microsoft hasn’t put it on release health as of Oct 24. Don’t hold the exploited Shell fix across the whole estate over this. Do pilot by hardware model.

Symptoms: At the finalizing reboot, affected machines show:

0xc000000d before the kernel loads, or “winload.efi missing or contains errors”
an Automatic Repair loop
a BitLocker recovery prompt

One organization saw it without full-disk encryption.

Who’s reporting it:

A Tech Community admin with about 50 Dells.
An admin who also names HP and Lenovo.
An MSP with two OptiPlex 7010 customers.
An AWS-hosted organization.
A Dell Community poster.
An r/sysadmin admin with a ~5,000-device fleet where a few Dell and Dynabook Tecra A60-M machines failed. It’s a small fraction, which is the usual shape of a firmware interaction.

A separate r/sysadmin thread reports sleep hangs and failed or rolled-back installs, and one commenter blames an Intel Modern Standby driver. That’s a different symptom, so it isn’t counted above.

Workarounds from the community, not from Microsoft:

From WinRE, run DISM with /revertpendingactions against the offline image, rebuild the boot files with bcdboot, and pause updates.
Or uninstall the update from WinRE.
Update BIOS and firmware before reapplying it.
Check ESP free space and Secure Boot events 1795/1796/1801.
Before any of that, make sure your recovery keys are in AD or Entra.

Sources: Tech Community thread, Dell Community, r/sysadmin 1xdcuys, r/sysadmin 1xasn7m, pcmasterinsider.