News / Industry
Microsoft's October 2026 Patch Tuesday fixes a record 1,411 flaws, one already exploited
Microsoft's October 2026 Patch Tuesday fixed a record 1,411 vulnerabilities and three zero-days. CVE-2026-96951, a Windows Shell bypass, is already exploited.
Microsoft's October 2026 Patch Tuesday is the largest on record. On October 13, the company shipped fixes for 1,411 vulnerabilities in a single monthly release, more than Tenable counted across all of 2025. The number is historic. The story inside it is smaller and more urgent: one of these flaws is already being used in attacks.
| Field | Detail |
|---|---|
| Release date | October 13, 2026 |
| Total vulnerabilities | 1,411 (a monthly record) |
| Rated critical | 70 (57 remote code execution, 11 elevation of privilege, 2 spoofing) |
| Zero-days | 3 (1 exploited, 2 publicly disclosed) |
| Actively exploited | CVE-2026-96951, Windows Shell, Mark of the Web bypass |
What happened
The 1,411 count excludes 348 other flaws Microsoft fixed earlier in the month, so the true October total runs higher still. For scale, Tenable counted 1,130 CVEs across the whole of 2025. A single month in 2026 now exceeds that annual figure.
Seventy of the fixes are rated critical: 57 remote code execution, 11 elevation of privilege, and two spoofing. Among them are a remote code execution flaw in Active Directory Domain Services (CVE-2026-70229) and one in Azure App Service (CVE-2026-77900), per BleepingComputer, both the kind of network-reachable service where a reliable exploit would carry weight.
Why so many at once? BleepingComputer attributes the surge to Microsoft's expanding use of AI tools to find and fix bugs in its own code. That is worth sitting with. A larger count does not mean a more dangerous month. It means the discovery pipeline got faster, and defenders now have to triage more output, from the same number of hours in a day.
The three zero-days
Three of the 1,411 were zero-days, meaning they were public or already under attack before a patch existed. One of the three sets the priority for the rest.
CVE-2026-96951: a Mark of the Web bypass, already exploited
Mark of the Web is the tag Windows attaches to any file that arrives from the internet. It is what triggers the warning, and the SmartScreen reputation check, when you open a downloaded document or installer. Defeating it strips that friction away, so a malicious file opens as if it were local and trusted. Microsoft describes the flaw as a command injection issue in Windows Shell, and its advisory states it allows "an unauthorized attacker to bypass a security feature over a network." Microsoft has not said how it was exploited or who reported it.
The category is familiar to defenders. Mark of the Web bypasses are a long-running staple of phishing and malware delivery, precisely because they neutralize a protection users lean on without thinking. MITRE tracks the technique as T1553.005, and researchers have documented variants abused in the wild for years, from malformed signatures to shortcut files that quietly drop the tag. A new one under active exploitation belongs at the top of the queue.
CVE-2026-108398: a .NET bypass of application control
The second zero-day was publicly disclosed but not yet seen in attacks. CVE-2026-108398 is a .NET Framework security feature bypass that can defeat Windows Defender Application Control (WDAC), the allow-list mechanism that governs which applications are permitted to run. Microsoft describes it as an "untrusted search path in .NET Framework" that lets "an authorized attacker" bypass a security feature locally, with no user interaction required. In practice, that means running code a policy was meant to block.
It was credited to James Forshaw of Google Project Zero, a researcher with a long history of finding ways the .NET runtime can slip past application control. WDAC is a containment control, not a front door, so this is a defense-in-depth gap rather than a remote break-in. It still matters to any organization that treats application control as a real barrier instead of a checkbox.
CVE-2026-92707: a denial of service in MessagePack-CSharp
The third, also publicly disclosed, is CVE-2026-92707, a denial of service flaw in MessagePack-CSharp, a widely used .NET library for the compact MessagePack serialization format. Microsoft describes it as "improperly controlled sequential memory allocation in .NET" that lets "an unauthorized attacker" deny service over a network, and rates it moderate. The library has a track record of denial of service issues when it deserializes untrusted input, so the services to check first are those that accept MessagePack from outside the trust boundary.
Prioritizing by real risk
A release of 1,411 is a sorting problem, not a patching marathon. Most of these flaws will never be weaponized, and treating all of them as equally urgent is how the few real exposures get lost in the noise.
A record patch count is a triage exercise: the one flaw under active exploitation sets your week, not the thousand that are not.
A grounded order of operations: patch CVE-2026-96951 first, because it is the only one confirmed in attacks. Next, the critical remote code execution bugs in internet-reachable services such as Active Directory and Azure App Service, where exposure is highest and the payoff for an attacker is real. Then the two publicly disclosed zero-days, which lower the bar for future abuse even where no campaign has surfaced yet. The long tail can follow your normal cycle.
This is the case for prioritizing by real risk rather than raw count. The useful question is not how many flaws Microsoft fixed. It is which of them touch systems you actually run and expose, and which one is already being used against someone. As AI tools push vulnerability discovery faster on both the finding and the fixing side, that triage becomes the work, and it is the reason to build security to be AI-native from the start rather than bolt it on after the numbers climb.