Microsoft Patches Record 1,413 Vulnerabilities in October
Microsoft's October 2026 Patch Tuesday updates have addressed a record-breaking 1,413 vulnerabilities, driven largely by AI-assisted code analysis and including an actively exploited zero-day flaw in Windows.
Radwan AbdulhadiEditor and technology writer
Record-Breaking Patch Tuesday
Microsoft's October 2026 Patch Tuesday updates have introduced a historic milestone by resolving a record-breaking number of vulnerabilities. According to the company, the latest wave of security updates resolves 1,413 Common Vulnerabilities and Exposures (CVEs). This massive batch includes 1,102 vulnerabilities affecting Windows, 134 in Office, 61 in developer tools, and 36 in SharePoint Server. Additional patches were also delivered for Exchange Server, Azure, Defender, and various other products.
Significantly, the volume of patches released in October alone exceeds the total number of vulnerabilities that Microsoft patched during the entirety of 2025. This sharp increase in findings has been largely driven by AI, pushing the total count of fixed flaws past 4,000 so far in 2026. A detailed report on how security teams use automated tools can be found via SecurityWeek, which notes that vulnerability discovery methods are evolving rapidly.
Exploited Windows Zero-Day Vulnerability
Among the thousands of resolved security issues, the most critical is an actively exploited zero-day vulnerability tracked as CVE-2026-96951, which carries a CVSS severity score of 8.8 out of 10. Detailed information and technical tracking on this specific bug are maintained in the official vulnerability advisory. Microsoft describes the issue as a Windows shell security feature bypass flaw that allows malicious actors to successfully evade Mark of the Web (MotW) defenses.
Mark of the Web tags files downloaded from the internet, instructing security systems such as Defender SmartScreen and Office Protected View to restrict automatic execution. Bypassing these MotW controls allows malicious files to launch directly without triggering standard security warnings. Attackers often exploit these types of defense mechanisms to compromise targets.
Explaining the attack vector, the tech giant noted that in an email or instant message scenario, an attacker could send a targeted user a specially crafted file designed to exploit the vulnerability. However, the attacker has no direct way to force a user to view attacker-controlled content and must instead convince the user to take action. The issue was independently reported to Microsoft by researchers at Fujitsu, Anthropic, and an independent expert.
In response to the active exploitation of the flaw, the Cybersecurity and Infrastructure Security Agency took swift administrative action. CISA added CVE-2026-96951 to its catalog and instructed federal civilian executive branch agencies to apply the necessary mitigations.
Publicly Disclosed Flaws and Additional Patches
In addition to the zero-day exploit, Microsoft addressed two other vulnerabilities that had been publicly disclosed prior to the release of official patches. The first of these is CVE-2026-108398, a flaw that permits an attacker to bypass Windows Defender Application Control (WDAC) enforcement, though Microsoft considers active exploitation of this issue unlikely.
The second publicly disclosed issue is CVE-2026-92707, a denial-of-service vulnerability affecting the MessagePack-CSharp component found within Visual Studio and .NET. Microsoft has not yet fully assessed the exploitability of this specific denial-of-service bug.
Introducing 'Risk Cohorts' for Prioritization
To help overwhelmed IT administrators and security teams manage the unprecedented volume of patches, Microsoft announced the introduction of 'risk cohorts'. The company elaborated on the concept in an official blog post detailing how organizations can approach security updates more efficiently.
A risk cohort is defined as a group of CVEs that require a similar customer assessment. While these grouped CVEs might not share a common root cause or identical CVSS scores, they share specific questions regarding customer environments that can effectively inform prioritization decisions. Microsoft emphasizes that risk cohorts serve only as a starting point rather than a final decision, reminding customers to continue evaluating each CVE individually based on active exploitation, severity, attack vectors, user interaction requirements, and product-specific guidance.
Sources
- SecurityWeekMicrosoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day
Continue chronologically
Related entity coverage
Related stories
Microsoft SharePoint Flaw CVE-2026-65660 Active Attacks
Microsoft SharePoint remote code execution vulnerability CVE-2026-65660 is actively exploited in the wild, prompting a strict CISA deadline.
Microsoft Posts Strong Cloud Growth in Q1 2027
Microsoft reported Q1 2027 earnings with $92.3 billion in revenue and $33.6 billion in net income, driven by cloud growth and reporting changes.
Microsoft Offers Voluntary Exit Buyouts to 60,000 Employees
Microsoft is offering voluntary buyouts to approximately 60,000 employees across multiple countries in an effort to cut costs and rework its workforce.
Microsoft Gives Copilot More Control Over Windows and Files
Microsoft has announced major upgrades to Copilot at its Windows and Surface event, introducing Hybrid Intelligence to manage local files and OS actions.
