Microsoft's October 2026 Patch Tuesday fixes more than 1,400 flaws, including an exploited Windows zero-day

A record release, and a counting problem

There is no single agreed total for this month, because each tracker draws the line in a different place. Tenable counts 1,407 CVEs, BleepingComputer and Infosecurity Magazine count 1,411, The Hacker News counts 1,413, and Trend Micro's Zero Day Initiative (ZDI) counts 1,415. The differences come down to what is included: BleepingComputer, for example, counts only what Microsoft released on Patch Tuesday itself and leaves out 348 flaws fixed earlier in October in Azure, Exchange Server and other services, as well as Edge and Mariner.

Whatever the exact figure, every count lands above 1,400. ZDI's Dustin Childs called it "the first four-digit volume we have ever seen", noting that a single month now exceeds what Microsoft used to patch in a full year. Tenable's Satnam Narang made the same point: October "far surpasses the previous record-setting year 2020, when Microsoft patched 1,261 CVEs", and "we've now crossed the 4,000 CVE mark with two months left to go."

Critical counts vary as well, from 69 (Tenable) and 70 (BleepingComputer) to 78 (Krebs on Security) and 85 (Cisco Talos). By BleepingComputer's breakdown, the bugs split as follows:

• 677 elevation of privilege
• 317 remote code execution
• 254 information disclosure
• 73 denial of service
• 40 security feature bypass
• 28 spoofing

Windows accounts for the bulk of the work, with about 1,100 of the CVEs, followed by Office (134), developer tools (61), SharePoint (36) and SQL Server (22), according to a product split published by BigGo.

The exploited zero-day: CVE-2026-96951

Microsoft titles CVE-2026-96951 a "Windows Shell Security Feature Bypass Vulnerability". It is rated Important with a CVSS 3.1 base score of 8.8 and is classed as command injection (CWE-77). In Microsoft's words, it "allows an unauthorized attacker to bypass a security feature over a network", and an attacker who exploits it "could evade Mark of the Web (MOTW) defenses".

Mark of the Web is the tag Windows attaches to files that arrive from the internet. It is what triggers the SmartScreen warning or Office's Protected View when you open a downloaded file. A bypass means a malicious file can open without those prompts, removing one of the main speed bumps between a phishing email and a compromised PC.

Microsoft marks the bug as "Exploitation Detected" but has not said who is using it, how, or against whom. The fix covers every supported client and server branch: Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations. Microsoft's affected-product list also includes Outlook.com.

AI shares the credit

Microsoft's acknowledgment lists four finders: a researcher credited as "yhw", Riku Bamba and Yuya Chudo of Fujitsu Limited, and "Benoit Sevens using Claude with Anthropic". It is one of the clearest examples yet of a large language model contributing to the discovery of a bug that attackers were already exploiting, though it was one of several independent reports, not a solo find by the AI.

CISA's October 16 deadline

CISA added CVE-2026-96951 to its Known Exploited Vulnerabilities (KEV) catalog on October 13. Under Binding Operational Directive 22-01, US federal civilian agencies must patch it by October 16, 2026. That deadline is only binding on those agencies, but CISA urges every organization to treat KEV entries as a priority.

Two more zero-days, publicly disclosed but not exploited

Two other bugs count as zero-days because details were public before a fix shipped. Neither is known to be exploited.

• CVE-2026-108398, a .NET Framework security feature bypass (CVSS 8.8) that defeats Windows Defender Application Control (WDAC), the allow-listing feature many enterprises use to block unapproved code. Microsoft rates exploitation "Less Likely". BleepingComputer credits James Forshaw of Google Project Zero.
• CVE-2026-92707, a denial-of-service flaw in MessagePack-CSharp (CVSS 5.3) affecting the SignalR MessagePack protocol package on .NET 8, 9, 10 and 11, Visual Studio 2026 18.10, Visual Studio 2022 17.14 and MessagePack 2.5.303.

The critical bugs to watch

The highest-scoring flaws this month are in Microsoft's cloud services rather than on customer machines: CVE-2026-96207, an elevation of privilege in Microsoft Partner Center (CVSS 10.0); CVE-2026-94510, an elevation of privilege in Microsoft Bookings (CVSS 9.9); and CVE-2026-77900, a remote code execution bug in Azure App Service for Linux (CVSS 9.8). None is publicly disclosed or exploited.

For on-premises administrators, two critical remote code execution flaws carry Microsoft's "Exploitation More Likely" rating and deserve fast attention:

• CVE-2026-70229 in Windows Active Directory Domain Services (CVSS 8.1), affecting Windows Server 2012 through 2025 and Windows 10 and 11.
• CVE-2026-70571 in Microsoft Exchange Server (CVSS 8.1), affecting Exchange 2016 CU23, Exchange 2019 CU14 and CU15, and Exchange Server Subscription Edition RTM. Microsoft shipped separate October Exchange Server security updates for these versions.

ZDI also flags 59 CVEs that meet its criteria for wormability, including bugs in DHCP Server, Network Policy Server and Windows Error Reporting. These are separate from the exploited Windows Shell flaw, which is not wormable.

Why the numbers keep climbing

October is the third record of 2026. July set a high of 570 CVEs, September raised it to 974, and October has jumped past 1,400. Back in July, Microsoft warned customers to "expect a deluge of patches, thanks in part to its use of multi-model agentic scanning harness (MDASH) technology", its in-house system that uses AI agents to hunt for bugs.

Brian Krebs summed it up: "Microsoft credits large language models for the high volume of bug discovery, and presumably AI gets credit for many of the patches used to fix these flaw[s]." The Claude credit on this month's exploited zero-day shows outside researchers are using the same tools.

The volume does not translate directly into risk. Krebs notes that just 26 Microsoft vulnerabilities have appeared in CISA's KEV catalog so far this year. Fortra's Tyler Reguly argues that "security leaders should focus on exploitable risk, and ask whether their teams have the clarity, capacity and support to act." In practice, that means patching the handful of exploited and likely-to-be-exploited bugs first rather than trying to triage 1,400 entries one by one.

Support changes and other vendors

October's update was the last one under mainstream support for Windows Server 2022, which ended on October 14, 2026. Security updates continue under extended support until October 15, 2031, so servers on 2022 are not losing patches. Windows 10, originally due to stop receiving updates in October 2025, has had its free support extended twice and now runs until October 2027.

Microsoft was not alone on Tuesday. Adobe published 11 bulletins covering 174 CVEs, with ColdFusion, Commerce and Experience Manager rated Priority 2. Atlassian, Cisco, Citrix, Dell, Docker, Fortinet, GitLab, Ivanti, Kiteworks, Progress Software, SAP and SonicWall have also released critical security updates this month.

What to do this week

1. Install the October 2026 cumulative update on every Windows PC and server. On a home PC, open Settings, then Windows Update, and select Check for updates.
2. Treat CVE-2026-96951 as the top priority across all Windows endpoints, since it is the one bug already being exploited.
3. Patch domain controllers and Exchange servers next, to close CVE-2026-70229 and CVE-2026-70571.
4. Update .NET Framework, especially if you rely on WDAC application control, to close CVE-2026-108398.
5. Until you are patched, be wary of unexpected attachments and links: a missing security warning is no longer proof that a file is safe.
6. Check the October updates from Adobe and the other vendors listed above if you run their products.

Sources

• Microsoft Security Response Center, October 2026 security updates: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951
• Zero Day Initiative, The October 2026 Security Update Review: https://www.zerodayinitiative.com/blog/2026/10/13/the-october-2026-security-update-review
• Tenable, Microsoft's October 2026 Patch Tuesday: https://www.tenable.com/blog/microsofts-october-2026-patch-tuesday-addresses-1407-cves-cve-2026-96951
• BleepingComputer: https://www.bleepingcomputer.com/news/microsoft/microsoft-october-2026-patch-tuesday-fixes-1-411-flaws-3-zero-days/
• Krebs on Security: https://krebsonsecurity.com/2026/10/microsoft-patches-more-than-1400-security-flaws/
• Infosecurity Magazine: https://www.infosecurity-magazine.com/news/microsoft-patch-tuesday-record-1/
• Security Affairs, CISA KEV addition: https://securityaffairs.com/200965/hacking/u-s-cisa-adds-microsoft-windows-shell-flaw-to-its-known-exploited-vulnerabilities-catalog.html
• Microsoft Learn, Windows Server 2022 lifecycle: https://learn.microsoft.com/en-us/lifecycle/products/windows-server-2022

Key takeaways

• Microsoft's October 2026 Patch Tuesday fixes more than 1,400 CVEs, its largest release ever and the third record of 2026.
• CVE-2026-96951, a Windows Shell Mark-of-the-Web bypass, is exploited in the wild and affects every supported Windows version.
• The bug needs user interaction, so phishing attachments and links are the likely delivery route.
• CISA requires US federal agencies to patch it by October 16, 2026; everyone else should patch now too.
• Microsoft credits AI-assisted bug hunting for the surge, and one of the zero-day's four finders used Anthropic's Claude.