Microsoft fixes over 1,400 vulnerabilities in record Patch Tuesday

Microsoft released its October 2026 Patch Tuesday on October 13, setting a record. BleepingComputer and Infosecurity Magazine report 1,411 CVEs, while SecurityWeek and SOCRadar report 1,413; Redmond Magazine says the total is more than 1,400. The update includes three zero-days: one actively exploited Windows Shell security feature bypass and two publicly disclosed flaws in .NET Framework and MessagePack-CSharp.

The exploited zero-day

Microsoft tracks the actively exploited vulnerability as CVE-2026-96951. The company describes it as a command injection in Windows Shell that lets an unauthorized attacker bypass the Mark of the Web feature over a network. Mark of the Web tags files downloaded from the internet so that SmartScreen and Office Protected View restrict automatic execution. Attackers can send a specially crafted file through email, instant message, or a malicious website, and the user must open it. Microsoft has not shared exploitation details or named a discoverer in its advisory. CISA added CVE-2026-96951 to its Known Exploited Vulnerabilities catalog on October 13 and set a federal agency deadline of October 16.

The other two zero-days

Microsoft also labels CVE-2026-108398 as a zero-day because it was publicly disclosed before a fix was available. This .NET Framework flaw lets an authenticated attacker with local access register a crafted assembly to load into a protected process, bypassing Windows Defender Application Control (WDAC) with no user interaction. Microsoft credits James Forshaw of Google Project Zero with the discovery. SecurityWeek reports Microsoft considers exploitation of CVE-2026-108398 unlikely. Infosecurity Magazine notes Microsoft labels the .NET Framework flaw "exploitation more likely". The third zero-day, CVE-2026-92707, is a publicly disclosed denial-of-service flaw in MessagePack-CSharp, a serialization library used in .NET applications; Microsoft has not reported active exploitation. Zero Day Initiative's review also lists CVE-2026-96951 as exploited and the other two as publicly disclosed.

Critical vulnerabilities and prioritization

The October release includes 70 critical vulnerabilities, 57 of which are remote code execution flaws, 11 elevation of privilege, and 2 spoofing. SecurityWeek breaks down the total as 1,102 Windows, 134 Office, 61 developer tools, and 36 SharePoint Server flaws, with Exchange Server, Azure, Defender, and other products also patched. Among the critical fixes are five Outlook remote code execution vulnerabilities rated 9.8, two reachable through the Reading Pane without user interaction. Alex Vovk, CEO of Action1, warned that the Outlook vulnerabilities are particularly dangerous for organizations relying heavily on Outlook. According to SOCRadar, a crafted message could trigger code execution without the recipient clicking anything. Amol Sarwate, head of security research at Cohesity, said Microsoft Outlook and Word remain common attack vectors. Microsoft introduced "risk cohorts" with this release, grouping CVEs that require a similar customer assessment, such as Office document and mail client flaws. The company said the approach is experimental and does not replace its existing patching recommendations. Neena Sharma, a director at Filigran, tied the fourth straight record month to AI-assisted vulnerability discovery and said teams must identify which flaws matter in their environments.

What defenders should check

SOCRadar's guidance says defenders should first deploy the October cumulative update to all Windows endpoints for CVE-2026-96951, starting with users who handle external email and downloads. They should patch Outlook and Office clients on the same schedule to close the Preview Pane flaws, patch network-facing services including DHCP servers, print servers, Message Queuing hosts, and Microsoft QUIC services, and patch Exchange Server and Active Directory Federation Services in the same window. Teams that rely on WDAC should install the .NET Framework update and confirm enforcement still blocks unapproved binaries. Development teams should scan for MessagePack-CSharp in dependencies and update services that accept untrusted input. Finally, verify installation with at least two signals and migrate systems that reached end of support on October 13, including Windows 11 24H2 Home and Pro and Windows 10 Enterprise LTSB 2016.