Microsoft Patches Record 1,413 Vulnerabilities in October, One Already Exploited

Microsoft's October Patch Tuesday, released October 13, is the biggest in the company's history. Its Security Update Guide lists 1,413 CVEs, up from the previous record of 1,261 in 2020.

Tallies differ slightly depending on how they are counted. BleepingComputer, which counts only what Microsoft published on Patch Tuesday itself, put the figure at 1,411 and said that excludes 348 flaws fixed earlier in the month. The release was also several hours late, well past the usual 1 p.m. Eastern drop.

What got fixed

Windows accounts for 1,102 of the 1,413 flaws, roughly 80%. Office has 134, Developer Tools 61, SharePoint Server 36 and SQL Server 22. The release spans 176 individual updates.

By type, more than 670 are privilege escalation bugs, over 300 are remote code execution and about 250 are information disclosure. More than 70 are rated Critical.

The exploited flaw

The urgent item is CVE-2026-96951, a Windows Shell security feature bypass. Microsoft says exploitation has been detected. The bug lets an attacker slip past Mark of the Web, the marker that makes Windows warn users before they open files from the internet.

Microsoft describes the cause as command injection in Windows Shell. An attacker would still need to get a user to click a link or open a malicious attachment. Microsoft has not said who is exploiting the flaw, how, or against whom.

CISA added the vulnerability to its Known Exploited Vulnerabilities catalog. Federal civilian agencies have until October 16 to patch.

Microsoft credited Fujitsu's Riku Bamba and Yuya Chudo, Anthropic's Benoit Sevens and a researcher identified as yhw with reporting the flaw. The advisory acknowledges reports from multiple organizations, none from inside Microsoft. Outlook.com was also affected but was patched in a build several weeks ago.

This is not the first Shell problem this year, and the sources count differently. Rapid7's Adam Barnett calls it the second exploited Windows Shell zero-day of 2026. Tenable's Satnam Narang counts three, including CVE-2026-21510, which he links to the APT28 group (Fancy Bear), and CVE-2026-32202, a fix for an incomplete patch of the first.

Narang says 26 Windows Shell vulnerabilities have been patched in 2026 through October. That compares with three in all of 2025 and one each in 2024 and 2022.

Other flaws to watch

CVE-2026-108398 is a .NET Framework flaw that Microsoft acknowledged as publicly known before the patch. It could let an attacker who already has a foothold bypass Windows Defender Application Control, now called App Control for Business, and run unauthorized applications. Microsoft has detected no exploitation.

BigGo Finance, summarizing Microsoft's release notes, lists a second publicly disclosed item: a denial-of-service bug in MessagePack-CSharp, CVE-2026-92707. Tenable's roundup separately flags a SharePoint flaw, CVE-2026-102866, that lets unauthenticated attackers exploit token validation weaknesses to hijack user accounts.

Outlook drew attention too. Microsoft fixed five remote code execution flaws where the preview pane is the attack path: CVE-2026-70242, CVE-2026-97749, CVE-2026-97016, CVE-2026-88156 and CVE-2026-70291. Rapid7 says simply scrolling past a malicious email could be enough to trigger some of them.

Outside Microsoft, GitLab patched CVE-2026-97229, which could let an unauthenticated user run code on self-managed servers through a crafted regular expression in a CI/CD configuration. IBM warned of CVE-2026-96119, a 9.9 CVSS flaw in IBM i versions 7.3 through 7.6. Atlassian reported exploitation attempts against CVE-2026-21589, which affects eight self-hosted products including Jira, Confluence and Bitbucket.

Why the numbers keep climbing

BleepingComputer says Microsoft continues to use artificial intelligence platforms to find and fix vulnerabilities in its products. Dustin Childs, head of Threat Awareness at Trend Micro's Zero Day Initiative, says AI is partly responsible.

"Hundreds of CVEs in a single release used to be the exception; now it's the baseline," Childs said. He argues AI is shortening the time between a bug existing and someone finding it, on both sides. "The volume isn't the real story anymore," he said, advising teams to prioritize what is proven, public and exploitable rather than triaging by raw CVE count.

Barnett of Rapid7 sees a different risk in the sheer volume. In his words, recent releases "can easily include several examples of potentially concerning vulnerabilities, each of which might have been more remarkable in its own right back when volumes were lower."

Rapid7 also flagged a gap in Microsoft's Edge reporting. Several Edge release-note entries point to new versions with Chromium fixes without listing the vulnerabilities addressed. When Rapid7 did its analysis, the Security Update Guide showed no Edge CVEs fixed in the opening part of the month, and the release notes said details would come later. That leaves defenders unable to tell which recent browser flaws have been patched.

Support ends for some Windows editions

October 13 also marked the end of updates for Windows 11 version 24H2 Home and Pro and for Windows 10 Enterprise LTSB 2016. Microsoft said this month's update is the last available for those editions.

Windows 11 23H2 Enterprise, Education and IoT Enterprise editions stop receiving security updates next month. The cumulative updates this month are KB5127648 for Windows 11 and KB5126657 for Windows 10.

The next Patch Tuesday is scheduled for November 11. Whether Microsoft ever discloses how CVE-2026-96951 was used in the wild remains open.

Before then, the October 16 federal deadline is the first test of how quickly agencies can push this batch through.