Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day
The most important is CVE-2026-96951, a security feature bypass flaw in Windows that has been exploited in the wild.
Microsoft’s October 2026 Patch Tuesday updates fix a record-breaking number of vulnerabilities, including a Windows zero-day exploited in the wild.
According to Microsoft, the latest updates resolve 1,413 CVEs, including 1,102 affecting Windows, 134 in Office, 61 in developer tools, and 36 in SharePoint Server. Exchange Server, Azure, Defender, and other products also received security patches.
This month alone, Microsoft patched more vulnerabilities than it did in all of 2025. The surge, largely driven by AI, has pushed the number of flaws fixed so far in 2026 past 4,000.
The exploited zero-day is tracked as CVE-2026-96951 (CVSS score 8.8/10). Microsoft describes it as a Windows shell security feature bypass flaw that enables an attacker to evade Mark of the Web (MotW) defenses.
MotW tags internet-downloaded files, signaling security mechanisms like Defender SmartScreen and Office Protected View to restrict automatic execution. Bypassing MotW allows malicious files to launch without triggering warnings.
“In an email or instant message attack scenario, the attacker could send the targeted user a specially crafted file that is designed to exploit the vulnerability,” the tech giant explained in its advisory. “In any case an attacker would have no way to force a user to view attacker-controlled content. Instead, an attacker would have to convince a user to take action.”
The issue was independently reported to Microsoft by researchers at Fujitsu, Anthropic, and an independent expert. No information has been shared about the zero-day attacks, but threat actors often exploit these types of MotW bypass vulnerabilities in their campaigns.
CISA added CVE-2026-96951 to its KEV catalog on Tuesday and instructed federal agencies to address it by October 16.
Two of the newly patched vulnerabilities were publicly disclosed before Microsoft made fixes available. One of them is CVE-2026-108398, which allows an attacker to bypass Windows Defender Application Control (WDAC) enforcement. Microsoft believes this flaw is unlikely to be exploited.
The second, which Microsoft has not assessed for exploitability, is CVE-2026-92707. It’s a DoS vulnerability affecting the MessagePack-CSharp component in Visual Studio and .NET.
Microsoft also announced on Tuesday the introduction of ‘risk cohorts’ to help users prioritize security updates.
“A risk cohort is a group of CVEs that require a similar customer assessment. The CVEs may not share a root cause or a CVSS score. What they share is a question about the customer environment that can inform prioritization,” Microsoft explained in a blog post.
It added, “Risk cohorts are a starting point, not a final decision. Customers should continue to review each CVE for active exploitation, severity, attack vector, user interaction, and product-specific guidance.”
