Microsoft Patch Tuesday Fixes Record 1,413 Flaws, Shell Zero-Day

A record-size patch release with one bug already under attack

Microsoft's October 2026 Patch Tuesday is the largest security update the company has ever shipped. Most outlets put the total at 1,413 vulnerabilities across Windows, Office, developer tools, SharePoint, Exchange, Azure and Defender.125 Only one of those flaws was confirmed to be under attack when the fixes went out. CVE-2026-96951 is a security feature bypass in Windows Shell, carries a CVSS score of 8.8, and lets attackers get around the Mark of the Web protection.12

The release came out on October 13.4 CISA added the Shell flaw to its Known Exploited Vulnerabilities catalog the same day and told federal civilian agencies to fix it by October 16.53 That gave agencies about three business days to patch whole Windows fleets.2

The headline number matters less than that deadline. Defenders face more than 1,400 CVEs, and the case for treating them as one undifferentiated pile has never been weaker.

Different firms report different totals

No two outlets agree on the exact count, and the spread is worth understanding. CrowdStrike's tally reaches 1,413, Tenable counts 1,407, and BleepingComputer reports 1,411.1311 BleepingComputer counted only the CVEs published on Patch Tuesday itself and left out 348 that were fixed earlier in October. Action1 counted 1,409 patches. Tech Times explained the gap mainly by whether cloud-service fixes released earlier in the month were included.

Critical-severity counts vary too. Tenable puts it at 69, CrowdStrike at 75, Cybernews at 78, and Dark Reading and Action1 at 80.131514 The overall shape is the same in every count. Windows alone accounts for 1,102 CVEs, or nearly four in five. Office has 134, developer tools 61, and SharePoint Server 36.124

The historical comparisons are where the size really shows. CyberScoop reports that this one month beats Microsoft's previous full-year record of 1,261 CVEs, set in 2020.12 Several outlets say it also tops all of 2025, and that Microsoft has now fixed more than 4,000 flaws so far in 2026.56 October is also the second record month in a row. September had already set a new high, though reports of its size range from 974 to 995 CVEs.1314

How the Shell zero-day works

Mark of the Web is a hidden tag Windows attaches to files that come from the internet. Several defenses depend on it, including SmartScreen, Office Protected View, Office's macro blocking, Smart App Control on Windows 11 and the Attachment Manager prompt, according to Automox researchers quoted by Dark Reading.14 Removing that tag doesn't just suppress one warning. It can quietly switch off several layers of protection at once. Tech Times described the effect as letting malicious files pass as documents created on the local machine.

Microsoft's advisory describes the expected attack: someone sends a specially crafted file by email or instant message and persuades the target to open it. Attackers can't force anyone to open the file.5 That fits the most common phishing pattern, which is why practitioners put the bug first in line despite its "important" rating rather than "critical."13 Microsoft hasn't said who is exploiting the flaw or how.115

Reports differ on who found it. Dark Reading credits Anthropic's Claude AI.14 CloudLink says Fujitsu, Anthropic and an independent researcher each reported it to Microsoft separately.5 These accounts can both be true, and taken together they suggest AI-assisted discovery played a part in at least one of the reports.

A pattern: attackers keep targeting Windows Shell

Tenable's Satnam Narang says this is the third Windows Shell flaw exploited in the wild this year.12 Tech-Insider found a steep rise in Shell patches overall: one in all of 2024, three in 2025, and 26 so far in 2026.2 On that outlet's count, Shell accounts for about a fifth of the zero-days confirmed exploited this year.2

Here is my reading of that trend. Endpoint defenses have improved at catching malicious payloads before they run. That makes the final warning prompt a more attractive target, and a Mark of the Web bypass is worth more to an attacker than its CVSS score implies. Tech-Insider makes a similar argument, saying attackers seem to have shifted toward flaws that suppress warnings.2 For ransomware crews and initial-access brokers who start with phishing, a working bypass of this kind is a useful tool.

Reports disagree on the other zero-days

Every outlet agrees on the exploited Shell bug. Coverage splits on the publicly disclosed ones. BleepingComputer and others list three zero-days in total.11 Dark Reading and Aviatrix list two.147

All reports agree that CVE-2026-108398 is one of them. It is an untrusted search path flaw in the .NET Framework that can be used to bypass Windows Defender Application Control enforcement.4 Tenable describes an attack in which a malicious .NET assembly gets loaded into a protected process.13 Microsoft considers exploitation unlikely.5

The third disclosed zero-day differs by source. BigGo, CloudLink and WindowsForum name CVE-2026-92707, a denial-of-service flaw in MessagePack-CSharp.45 Shattered, citing CSO Online, names CVE-2026-102866, a SharePoint token-validation bug that could let an unauthenticated attacker take over accounts.13 Most outlets that list the full set point to MessagePack, so that is the likelier answer. SharePoint administrators should still review the critical fixes for their product.

Some early coverage was simply wrong. One widely shared post said the exploited bug was in the Common Log File System driver. Another listicle said all three zero-days were being actively exploited.10 Neither matches Microsoft's release notes, which identify the Windows Shell bypass as the only exploited flaw.4 Mistakes like these show how a huge release can spread misinformation and send triage teams after the wrong problems.

Other high-risk fixes

Several other fixes deserve quick attention. Tech Times reports five Outlook remote code execution flaws that trigger through the Reading Pane, so the user doesn't have to click anything. Aviatrix flags a 9.8-rated heap overflow in Microsoft QUIC that allows unauthenticated remote code execution.7 Two Exchange Server bugs and one Active Directory Domain Services bug are rated "Exploitation More Likely."13

The 36 SharePoint fixes carry extra weight. Earlier this year, the ToolShell exploit chain against unpatched on-premises SharePoint servers drove the Warlock ransomware campaign across several sectors.2 SharePoint has a recent record of turning patch delays into breaches.

The timing makes things harder. In the same week, Palo Alto Networks fixed an exploited PAN-OS zero-day and Cisco patched an actively exploited flaw in its Secure Email Gateway. Ivanti Connect Secure was also under attack.213 Support deadlines add more pressure. Windows Server 2012 and 2012 R2 used up their Extended Security Update coverage this week, and Windows 11 version 24H2 Home and Pro editions reached the end of updates.4

Why the counts keep rising

Microsoft says its growing use of AI to find and fix vulnerabilities means monthly releases will keep getting bigger. Tech Times reports the company is using AI tools to audit its own code and is surfacing old bugs that human reviewers missed for years. Across the industry, Aviatrix notes that annual CVE disclosures grew from 30,949 in 2023 to nearly 50,000 in 2025. Dark Reading calls this the "vulnpocalypse era."714

Researchers agree on one point: the total tells you little about real risk. Fortra's Tyler Reguly argues the counts mean almost nothing. He points instead to how many Microsoft CVEs made CISA's exploited-vulnerabilities list: 26 so far in 2026, compared with 30 last year and 32 the year before.9 Trend Micro's Dustin Childs, quoted by CyberScoop, notes that Microsoft had 15 exploited zero-days from January through October this year, compared with 17 over the same months of 2023.12 Narang also says raw totals are close to meaningless.13

The main takeaway is that AI-driven auditing is finding many more bugs, but in-the-wild exploitation hasn't risen with it. What has changed is the amount of work. Patch prioritization now has to be done in a way that scales.

Microsoft's "risk cohorts" and their limits

Microsoft is testing "risk cohorts" that group related fixes so administrators can decide on them together.15 WindowsForum notes the benefit: a team can answer a question like whether it exposes RD Gateway once and apply that answer to dozens of CVEs. It also identifies the main risk. Ranking cohorts by size would bury a single critical CVE such as the Shell zero-day.

That warning is right. Cohorts help get through a release of more than 1,400 bugs, but they can't replace knowing what's actually being exploited. The order of work is the same as before: first the exploited Shell bypass, then the WDAC bypass where application control matters, then Exchange, Active Directory, Outlook and SharePoint. October showed that confirmed exploitation, not severity scores or the total count, should decide what gets patched first.