# October 2026 Windows update: install it, but not blindly URL: https://casterconsulting.hu/en/windows-october-2026-update/ Published: 2026-10-17 Updated: 2026-10-17 Author: Caster Consulting > Install the October Windows update within a week, because it fixes a flaw attackers already exploit. Test it on a few machines first: an NTLM change can break Wi-Fi and VPN sign-in, and Windows 11 24H2 Home and Pro devices just received their last update. **Short answer: install it within a week, but on two or three machines first.** The October Windows update is the largest Microsoft has ever shipped, and it fixes a flaw attackers are already exploiting. Waiting weeks is a bad idea. Pushing it blindly to every device is a bad idea too: a deliberate security change can break company Wi-Fi and VPN sign-in, and for a lot of machines this was the last update they will ever get. ## What happened? Microsoft released its monthly security updates on 13 October. Tenable counts 1,407 fixed vulnerabilities, CrowdStrike counts 1,413; the gap comes down to whether you include cloud-service fixes Microsoft had already shipped earlier in the month. Whichever number you take, it is the second record-sized release in a row. The item that matters most is CVE-2026-96951, a Windows Shell flaw. Microsoft says attackers are already exploiting it. The method is simple: send a file by email or message, and if the user opens it, the file slips past "Mark of the Web". That is the tag Windows puts on files downloaded from the internet, and it is what triggers warnings and restrictions. CrowdStrike's analysis adds that 23 Office flaws in this release can be triggered just by showing a malicious file in the preview pane, without opening it. Two side effects came with it. - **NTLMv1 blocking:** where the `BlockNtlmv1SSO` setting has not been configured and Credential Guard is off, Windows now blocks single sign-on that relies on old NTLMv1-derived credentials by default. According to Microsoft, this can affect Wi-Fi, Ethernet and VPN sign-in that uses MS-CHAPv2-based authentication, particularly on domain-joined machines. The Register points out that this is not a bug but a deliberate step towards retiring NTLM. - **Smart App Control:** BleepingComputer reports that after the Windows 11 update (KB5127648), this protection cannot be switched back on if it had been turned off earlier. Devices where it is already on are not affected. And one deadline passed quietly: according to Microsoft's lifecycle page, Windows 11 version 24H2 Home and Pro reached end of servicing on 14 October. For those machines, October was the last security update. ## What does this mean for a small business? In a small company, patching is rarely a process. It is a habit. Either everyone updates whenever the machine nags them, or someone postpones it for months because the last update broke the printer. Neither works in a month like this one. Because the flaw is already being exploited, waiting is now the risk. And the attack lands exactly where small businesses are weakest: a believable email with an attachment. The NTLM change shows that blind installation is a risk too. If the office Wi-Fi still runs on an old configuration, ten people may not be able to connect on Monday morning. That is not a disaster. But if nobody knows the cause, it eats a whole morning. The 24H2 Home and Pro machines are the quietest problem. They get no further fixes, even if next month brings another exploited flaw. Many small businesses run Pro editions, and nobody checks which version is installed. A note for anyone in the EU working towards NIS2: vulnerability handling is one of the risk-management measures the directive lists, and patching is the most visible part of it. A simple, written rule ("security updates go out within seven days, after a test group") is cheap evidence that you take it seriously. Whether NIS2 applies to you at all is covered in [NIS2 for SMEs](/en/nis2-smes-does-it-apply/). ## What should you do now? 1. **Pick two or three test machines,** ideally from different roles (office, finance, field staff, someone who uses the VPN). Install the update there first and watch them for a day or two: does Wi-Fi work, does the VPN connect, does printing work, does your accounting software start? 2. **If all is well, roll it out to everyone within a week.** Don't leave it until next month because of the exploited flaw. If you use Intune or another device management tool, schedule it there; if not, at least keep a list of who has updated. 3. **Check which version each machine runs.** The `winver` command shows it. Move 24H2 Home and Pro machines to version 25H2 or later, because they no longer receive fixes. 4. **If Wi-Fi or VPN sign-in breaks,** look for event 4025 in the Windows event log (NTLM/Operational): it means Windows blocked an NTLMv1-based sign-in. As a temporary workaround, Microsoft allows setting `BlockNtlmv1SSO` to 0, but this lowers protection. Keep it narrow and short, and move your network authentication to a modern method in the meantime. 5. **Tell your staff what to watch for.** The exploited flaw depends on someone opening a file. A short reminder ("don't open unexpected attachments, ask first") is worth more this month than usual. ### How to measure whether your patching works You don't need a dashboard. Three numbers are enough: how many devices you have, how many of them installed the October update within seven days, and how many run a Windows version that is out of support. If the second number is below the first, or the third is above zero, you know where to start next month. If nobody owns patching in your company, that is worth settling first; our article on [in-house or outsourced IT operations](/en/in-house-or-outsourced-it-operations/) helps with that. And if you want devices and a network where updates are no longer a monthly gamble, take a look at our [infrastructure](/en/infrastructure/) service. ## Sources - [Tenable – Microsoft's October 2026 Patch Tuesday Addresses 1,407 CVEs (CVE-2026-96951)](https://www.tenable.com/blog/microsofts-october-2026-patch-tuesday-addresses-1407-cves-cve-2026-96951) - [CrowdStrike – October 2026 Patch Tuesday: Updates and Analysis](https://www.crowdstrike.com/en-us/blog/patch-tuesday-analysis-october-2026) - [Microsoft – Upcoming changes to NTLMv1 in Windows 11, version 24H2 and Windows Server 2025](https://support.microsoft.com/help/5066470) - [The Register – Networking problems after the October 2026 Windows update? NTLM might be to blame](https://www.theregister.com/security/2026/10/16/networking-problems-after-the-october-2026-windows-update-ntlm-might-be-to-blame/5303503) - [BleepingComputer – KB5127648 Windows security update may break Smart App Control](https://www.bleepingcomputer.com/news/microsoft/kb5127648-windows-security-update-may-break-smart-app-control/) - [Microsoft Learn – Windows 11 Home and Pro lifecycle](https://learn.microsoft.com/en-us/lifecycle/products/windows-11-home-and-pro) - [EUR-Lex – Directive (EU) 2022/2555 (NIS2), Article 21](https://eur-lex.europa.eu/eli/dir/2022/2555/oj)