Microsoft's October Patch Tuesday fixes about 1,413 CVEs, a record, including CVE-2026-96951, an exploited Windows Shell Mark-of-the-Web bypass. What to patch first.
Microsoft's October security release, published on Tuesday, October 13, fixes about 1,400 vulnerabilities. The exact figure depends on who is counting. SecurityWeek, CyberScoop and The Hacker News report 1,413 CVEs, Tenable counts 1,407 across 301 products and components, and BleepingComputer lists 1,411 because it leaves out 348 flaws, Edge among them, that were fixed earlier in the month. Whichever number you take, it is a record.
It is also the second record in a row. September's release had 998 CVEs. October 2025's had 180. CyberScoop notes that Microsoft's biggest previous year, 2020, came to 1,261 CVEs in total - so this one month beats any earlier whole year, and SecurityWeek adds that it beats all of 2025 combined. The 2026 total is now past 4,000.
Windows takes the bulk of it: 1,102 CVEs, about 80% of the release, followed by Office (134), developer tools (61) and SharePoint Server (36), with Exchange Server, Azure and Defender also patched. By type, BleepingComputer counts 677 elevation-of-privilege bugs, 317 remote code execution, 254 information disclosure, 73 denial of service, 40 security feature bypass and 28 spoofing. About 70 are rated Critical - 70 by BleepingComputer's count, 69 by Tenable's.
Only one of the 1,400 is known to be exploited. CVE-2026-96951 is a security feature bypass in Windows Shell, scored 8.8 on CVSS and rated Important rather than Critical. It lets a crafted file escape the Mark of the Web, the tag Windows attaches to anything downloaded from the internet or received by email.
That tag is what several defences check before they act. Microsoft Defender SmartScreen uses it to decide whether to warn about a download with no reputation, Office Protected View uses it to open internet files read-only behind a yellow message bar, and Smart App Control on Windows 11 relies on it too. A file without the mark gets none of those checks. Microsoft files the root cause under command injection.
The attack still needs the victim to open the file. According to Tenable, attackers send specially crafted files by email or instant message and use social engineering to get them opened. Microsoft has not said who is exploiting the flaw or how widely. SecurityWeek credits the discovery to Fujitsu, Anthropic and an independent researcher.
On the same day, CISA added the bug to its Known Exploited Vulnerabilities catalog, alongside an Ivanti Connect Secure authentication bypass, and gave US federal civilian agencies until October 16 to fix it. That deadline binds only those agencies, but a three-day window says how seriously to take it. It is part of a pattern, too. CyberScoop counts this as the third exploited Windows Shell flaw of 2026, out of 26 Windows Shell fixes this year, against 3 in all of 2025.
Microsoft's explanation, as quoted by BleepingComputer, is that it is "using artificial intelligence platforms to find and remediate security vulnerabilities" in its products. The code did not get worse in a month. The search through it got faster.
Dustin Childs of TrendAI's Zero Day Initiative told CyberScoop that "hundreds of CVEs in a single release used to be the exception - now it's the baseline." AI, he said, "isn't creating these bugs out of thin air; it's just shortening the time between a vulnerability existing and someone noticing it." His conclusion: "What matters is that discovery is scaling faster than exploitation."
For defenders the cost is concrete. A patch team that used to read every bulletin cannot read 1,413 of them in the few days before machines need rebooting.
Alongside the release, the Microsoft Security Response Center published a proposal it calls risk cohorts. "A risk cohort is a group of CVEs that require a similar customer assessment," the post says. Cohorts share the question an admin has to ask about their own environment - do we run RDP gateways, do we expose DNS servers - rather than a root cause or a severity score.
October's release splits into 15 provisional cohorts. The largest are Windows filesystems, storage and backup (136 CVEs), Office document and mail clients (135), Windows graphics, media and content processing (131), Windows core and kernel privilege boundaries (109) and Windows installation, deployment and update services (103). Further down sit DNS, DHCP and network-address infrastructure (76), remote access and RDP (65) and directory, federation and certificate infrastructure (24).
Microsoft is careful about what this is not: "We are not announcing a new Microsoft vulnerability classification or prioritization framework, and we are not committing to a specific product integration or publication model." According to iTnews, the cohorts will not appear in the Security Update Guide for now. MSRC's own advice for most customers is still to "install the appropriate security updates as soon as possible."
The second change is more mechanical. Starting with this release, Microsoft Threat Intelligence says the company publishes Vulnerability Exploitability eXchange (VEX) statements for all Microsoft-assigned CVEs. These are machine-readable notes on whether a product is actually affected. A team whose scanner flags every CVE in a shared component can use them to close tickets automatically instead of one by one.
Two more flaws were publicly disclosed before a fix existed, but neither is known to be exploited. CVE-2026-108398 (CVSS 8.8), found by James Forshaw of Google Project Zero, is a .NET Framework bypass of Windows Defender Application Control that lets code run in protected processes. CVE-2026-92707 is a denial-of-service bug in MessagePack-CSharp, a library used in Visual Studio and .NET.
Among the critical fixes, Tenable highlights remote code execution in Windows Active Directory Domain Services (CVE-2026-70229) and Exchange Server (CVE-2026-70571), both CVSS 8.1. Exchange got its own October security update. MSRC also issued advisory ADV260001, which hardens ReFS volumes on removable media.
The Windows packages are KB5127648 and KB5126653 for Windows 11 and KB5126657 for Windows 10 under Extended Security Updates.
For anyone running Windows fleets, the order is clear. Push the fix for CVE-2026-96951 first, and until it is installed, treat SmartScreen, Protected View and Smart App Control as unreliable for attachments that arrive by email or chat. Then work through the Active Directory and Exchange fixes, which matter most to anyone running those servers on premises.
The calendar matters as well. October is the final security update for Windows 11 version 24H2 Home and Pro and for Windows 10 Enterprise LTSB 2016. Those machines get nothing after this, so 24H2 Home and Pro devices need to move to 25H2. Windows 11 23H2 Enterprise, Education and IoT lose security updates in November.
At home, Windows Update does the work: Start, Settings, Windows Update, Check for updates, then Install or Restart now, until it reports "You're up to date." Our coverage of the July and August releases shows how fast the curve has bent - August's 421 CVEs looked large at the time. Figures here were checked on October 15, 2026, against Microsoft's release notes.
Hero photo: Building 92 at Microsoft headquarters in Redmond, by Coolcaesar via Wikimedia Commons, CC BY-SA 4.0. SmartScreen and Windows Update images via Wikimedia Commons and Microsoft Learn.