Microsoft's October Patch Tuesday fixes a record 1,400+ flaws, including exploited zero-day

Microsoft released its October 2026 Patch Tuesday updates on October 13, fixing a record number of vulnerabilities, including one Windows zero-day that attackers are already exploiting. BleepingComputer counts 1,411 flaws, excluding 348 fixed earlier in the month in Azure, Exchange Server and other products, while The Hacker News puts the total at 1,413. Both outlets describe it as the largest Patch Tuesday release to date. Because one of the flaws is under active attack, administrators should prioritize this cycle.

What happened

According to BleepingComputer, the release includes 70 Critical vulnerabilities: 57 remote code execution bugs, 11 elevation of privilege flaws and 2 spoofing issues. By the outlet's approximate breakdown, the fixes span 677 elevation of privilege, 317 remote code execution, 254 information disclosure, 73 denial of service, 40 security feature bypass and 28 spoofing vulnerabilities.

The Hacker News reports that Windows accounts for 1,102 of the fixes, followed by Office (134), Developer Tools (61), SharePoint Server (36) and SQL Server (22). The release follows September's update, which addressed nearly 1,000 vulnerabilities. Tenable's Satnam Narang told the outlet that Microsoft has patched more than 4,000 CVEs so far this year.

Technical details

The actively exploited flaw is CVE-2026-96951 (CVSS 8.8), a command injection issue in Windows Shell that allows an unauthenticated network attacker to bypass a security feature. Microsoft says an attacker could evade Mark of the Web (MOTW) protections, for example by sending a specially crafted file in an email or instant message. The Hacker News notes that it is unclear how, by whom or against whom the bug has been exploited. CISA added it to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch by October 16, 2026.

Two other flaws were publicly disclosed before patches were available:

• CVE-2026-108398 (CVSS 8.8): an untrusted search path flaw in .NET Framework that a local, authorized attacker could use to bypass Windows Defender Application Control (WDAC) without user interaction. It was credited to James Forshaw of Google Project Zero. Action1's Mike Walters warned that it is especially dangerous as a post-compromise technique.
• CVE-2026-92707 (CVSS 5.3): a denial-of-service flaw in MessagePack-CSharp.

The Hacker News also highlights CVE-2026-21413 (CVSS 9.8), a heap-based buffer overflow in the Raw Image Extension. It can be triggered when Windows generates a thumbnail or preview, so simply browsing to a folder that contains a malicious RAW image may be enough.

Microsoft also introduced "risk cohorts" that group CVEs requiring similar assessment. BleepingComputer reports the company calls this approach experimental and says the cohorts do not necessarily indicate the most dangerous flaws.

Who is affected

Most supported Windows, Office, .NET, SharePoint and SQL Server deployments are affected. BleepingComputer notes that Windows 11 24H2 Home and Pro and Windows 10 Enterprise LTSB 2016 have reached end of updates, making this their final release. Windows 11 23H2 Enterprise, Education and IoT Enterprise will stop receiving security updates next month.

What to do

Administrators should prioritize CVE-2026-96951, especially on endpoints that receive email attachments and files over messaging apps. The Raw Image Extension and .NET Framework fixes should follow. The Zero Day Initiative's Dustin Childs said that releases with hundreds of CVEs "used to be the exception; now it's the baseline," and argued that triage should focus on exploitability rather than raw CVE counts. Systems running Windows versions that have reached end of updates should be moved to a supported release.