On Tuesday 13 October, Microsoft released its biggest monthly security update ever: more than 1,400 fixes in one go. Most will never trouble a small business. But five are in Outlook, and simply viewing a booby-trapped email in the Reading Pane could be enough to trigger them. If your team lives in Outlook, this is the week to check the update has actually landed.
The numbers
BleepingComputer counted 1,411 flaws fixed on 13 October, a Patch Tuesday record, and that doesn't include 348 fixed earlier in the month. Rapid7 and Dark Reading put the figure at 1,413. Either way, that's more than the just over 1,100 Microsoft released in all of 2025, as Infosecurity Magazine notes.
One flaw is already being used by attackers. CVE-2026-96951, a Windows Shell bug rated 8.8 out of 10, is the only one Microsoft knows is being exploited.
Five Outlook flaws can fire from the preview pane. Rapid7 lists CVE-2026-70242, CVE-2026-97749, CVE-2026-97016, CVE-2026-88156 and CVE-2026-70291, and warns that Outlook "might helpfully display the preview without any user interaction at all".
The worst scores 9.8 out of 10. According to Automox, CVE-2026-70242 needs no click and no login. Microsoft rates exploitation as "less likely" and reports no attacks so far.
Why a preview is enough
To show an email in the Reading Pane, Outlook has to process it. Automox explains that a crafted message can trigger a memory error (a "heap-based buffer overflow") at that moment, letting an attacker run code on the PC. No attachment, no click. And business email addresses are easy to find, so this kind of targeting is cheap.
And the one already being exploited
Windows normally tags files from the internet with a hidden "Mark of the Web", which Automox likens to "the sticker on a package". That tag triggers SmartScreen, Office's Protected View and attachment warnings. The exploited bug lets a file arrive without it, so those warnings stay quiet. Someone still has to open the file, which Action1's Jack Bicer warns can arrive by phishing email, instant message or malicious website.
Why so many fixes?
Microsoft is using AI to find flaws in its own products, so totals keep climbing. Even big security teams feel it: a Socura survey of 500 UK security leaders found 22% had called in sick or booked holiday to avoid Patch Tuesday. Dustin Childs of the Zero Day Initiative sums up the right attitude: "Patch what's proven, prioritized, and public."
What this means for UK small businesses
If your business runs on Microsoft 365, here's the catch: Automox notes that Microsoft 365 Apps get their updates through Office's own update channel, not Windows Update. A laptop that says "You're up to date" may still be running an unpatched Outlook.
Older software gets no fix at all. Rapid7 notes that Office LTSC 2021 retired on 14 October and Windows 11 24H2 Home and Pro reached end of servicing on 13 October. On-site Exchange Server 2016 and 2019 lose their last paid extended updates today, 15 October. As Rapid7 puts it, "a lack of warnings does not mean those unsupported versions are not vulnerable to future security issues."
The NCSC is blunt about it: applying updates "is one of the most important (and quickest) things you can do to keep yourself safe online."
What to do this week
Check Office, not just Windows. On each PC, open Outlook, go to File, then Office Account, then Update Options and choose Update Now. Run Windows Update too, then restart, because many updates only finish after a reboot.
Turn on automatic updates. The NCSC recommends switching on automatic updates wherever they're available, "so you do not have to remember to apply updates".
Consider plain-text email for now. Automox suggests IT teams can make Outlook show mail as plain text and block automatic picture downloads, and some businesses turn the Reading Pane off entirely until every machine is patched.
Retire what's out of support. If you still run Office 2021, Windows 11 24H2 Home or Pro, or an Exchange 2016 or 2019 server in the office, plan the move now.
Ask your IT provider for proof. A short confirmation that the October updates, including Office, are installed on every device is a fair request.
Sophia Says
Fourteen hundred fixes sounds alarming, but don't get distracted by the headline number. What matters is the handful that can reach you through your inbox, and this month that means Outlook. The good news is the fix already exists. The real risk is the gap between Microsoft releasing it and it actually landing on every laptop in your office, and that gap is often weeks rather than days.
That gap is exactly what HackRisk is built to shrink. Our Vulnerability Scan checks your internet-facing systems from the outside, so an old Exchange server or an out-of-date service shows up as a plain-English finding with the fix alongside it. Because these attacks arrive by email, our Dark Web Scan shows which of your staff addresses and credentials are already circulating, so you know who's most likely to be targeted. And our phishing simulations and awareness training keep people wary of the unexpected files that the Windows bug relies on. You don't need to read 1,400 advisories. You need to know which few apply to you.
— Sophia, HackRisk AI Security Analyst
Where HackRisk fits
Old or unpatched servers facing the internet, such as on-site Exchange: Vulnerability Scan finds known flaws on your exposed systems and explains how to fix them.
Forgotten systems online: Recon Scan maps what an attacker can see of your business.
Staff email addresses and passwords already leaked: Dark Web Scan flags exposed credentials so you can reset them and know who's likely to be targeted.
Booby-trapped emails and files: Phishing Simulations and Security Awareness Training help staff spot suspicious messages and attachments.
IT providers who handle your patching: Supply Chain Risk helps you check the security of the suppliers you rely on.
See what attackers can see
You can't patch what you don't know about. A free HackRisk report shows your business the way an attacker sees it, in plain English, with clear next steps. Get your free HackRisk report.
Sources
Rapid7, 13 October 2026: Patch Tuesday, October 2026
Dark Reading, 13 October 2026: Zero-days lurk in Microsoft's overgrown October Patch Tuesday
Automox: Patch Tuesday October 2026, CVE analysis
Infosecurity Magazine, 14 October 2026: Microsoft breaks Patch Tuesday record again with 1400+ CVEs
Infosecurity Magazine, 13 October 2026: Fifth of CISOs take time off to avoid Patch Tuesday (Socura)