Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day
Reported exploitedMicrosoft WindowsMicrosoft OfficeOur summary
Microsoft's October 2026 security update sets a new record, resolving 1,413 CVEs in one release — more than the company fixed across all of 2025. The bulk of the fixes target Windows (1,102 flaws), with additional patches for Office (134), developer tools (61), SharePoint Server (36), plus Exchange Server, Azure and Defender.
Among the fixed issues is an actively exploited zero-day, CVE-2026-96951 (CVSS 8.8), a Windows shell flaw that lets attackers bypass the Mark of the Web security check, allowing malicious downloaded files to run without triggering Defender SmartScreen or Office Protected View warnings. CISA has added it to its Known Exploited Vulnerabilities catalog and ordered federal agencies to remediate by October 16.
Two other vulnerabilities were publicly known before patches shipped: CVE-2026-108398, a Windows Defender Application Control bypass considered unlikely to be exploited, and CVE-2026-92707, a denial-of-service bug in the MessagePack-CSharp component affecting Visual Studio and .NET, whose exploitability hasn't yet been assessed. Microsoft also introduced a new 'risk cohort' grouping system to help organizations prioritize which of this massive patch batch to apply first.
SecurityWeek publishes this story on its own site; we link to it rather than reprint it.
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.