Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug

Microsoft's October Patch Tuesday set a new high-water mark, delivering fixes for 1,413 vulnerabilities across Windows, Office, .NET Framework, SQL Server, Developer Tools and SharePoint Server—surpassing last month's previous record of nearly 1,000. Among them is CVE-2026-96951, an 8.8-severity command injection flaw in Windows Shell that lets attackers bypass security protections and evade Mark of the Web defenses via malicious files or links; Microsoft confirms this one is already being abused in real-world attacks, prompting CISA to add it to its Known Exploited Vulnerabilities catalog with a fix deadline of October 16. Two other flaws stand out: CVE-2026-108398, a publicly disclosed .NET Framework issue that can bypass Windows Defender Application Control without user interaction, and CVE-2026-92707, a denial-of-service bug in MessagePack-CSharp. Microsoft also patched a critical 9.8-rated Raw Image Extension flaw (CVE-2026-21413) that can trigger remote code execution merely by generating a thumbnail preview. With over 4,000 CVEs fixed this year alone, Microsoft is rolling out a new 'risk cohort' grouping system to help organizations prioritize which of the flood of bugs truly need urgent attention.