Patch Tuesday October 2026: Record 1,411 Fixes, Shell Zero-Day

A record release with one bug that matters most

On October 13, Microsoft shipped the biggest Patch Tuesday in its history. BleepingComputer counted 1,411 vulnerabilities, including one zero-day that attackers were already exploiting and two that had been publicly disclosed before a fix existed.11 Other trackers put the total close to that figure. Tenable counted 1,407 CVEs, Action1 counted 1,409 patches and Automox counted 1,408. CrowdStrike's running tally reached 1,413, and SecurityOnline reported 1,414.13814

The exact number matters less than how much it has grown. Automox said September's 973 CVEs had set a record that lasted only one month, and that October's release was about 45% larger.8 Tenable called this the second month in a row that Patch Tuesday set a new high. BleepingComputer linked the jump to Microsoft's growing use of AI platforms to find and fix flaws in its own products.11 That is the most likely explanation for a backlog of this size. Whatever the cause, defenders now get a monthly release large enough that it has to be planned like a project.

The practical answer is to ignore the headline number and start with the one flaw attackers are using. Nearly every outlet that covered the release reached the same conclusion.

CVE-2026-96951: the Windows Shell zero-day

The vulnerability under active attack is CVE-2026-96951, a security feature bypass in Windows Shell. According to BleepingComputer, it lets attackers get around Mark of the Web, the label Windows attaches to files downloaded from the internet.11 Microsoft describes the root cause as command injection: Windows Shell fails to neutralize special elements in a command, which lets an unauthorized attacker bypass a security feature over a network.11 Lansweeper says the likely attack starts with a crafted file sent by email or instant message, or a link to a site the attacker controls. It adds that every supported Windows client and server version is affected.10

The flaw has a CVSSv3 score of 8.8. Microsoft rates it only "Important", not Critical. This is a familiar gap between severity labels and real-world risk. Mark of the Web bypasses do not run code on their own. They remove the warning that might make a user stop before opening a malicious file, which is why they show up so often in phishing and malware delivery chains. SecurityOnline reported that CISA has also confirmed exploitation and set an October 16 deadline for federal agencies to patch.14 That gives agencies only a few days and shows how seriously the agency takes the bug.

This is not the first such case this year. Shattered.io called it the third Windows Shell zero-day exploited in 2026. Ivanti also noted that Windows Shell has been a repeated zero-day target this year.4 Microsoft has not said who reported the flaw or how it was used in attacks.11 Without that information, defenders cannot hunt for specific indicators. Patching is the only dependable fix.

The disclosed zero-days: some agreement, some confusion

Coverage of the publicly disclosed flaws is less consistent, and the differences are worth explaining.

The outlets agree on CVE-2026-108398, a .NET Framework security feature bypass caused by an untrusted search path.11 Automox describes the attack: someone places a crafted .NET assembly on a machine and registers it to load into a protected process. Code then runs inside that process without triggering Windows Defender Application Control (WDAC).8 Google Project Zero researcher James Forshaw is credited with finding it.11 Ivanti says it affects .NET Framework 3.5 and versions 4.6.2 through 4.8.1.4 The attacker needs local access and must already be authenticated, so this is not an initial-entry bug. It does undermine application allowlisting, which many organizations rely on to block exactly this kind of code.

The outlets disagree about whether there is a third zero-day, and which one it is. BleepingComputer, Windows Forum and Analytics Insight list CVE-2026-92707, a denial-of-service flaw in MessagePack-CSharp caused by improperly controlled memory allocation.1113 Shattered.io names CVE-2026-102866, a SharePoint flaw, as the third zero-day instead. Tenable and Automox both count two zero-days, with only CVE-2026-108398 publicly disclosed.8 Action1 also reports two.13 Windows Forum reads the gap as a difference in definitions, not a factual dispute. That seems right, because a library-level DoS flaw in a widely used serialization package fits some trackers' idea of a zero-day and not others'.13

Some of the details are clearly wrong. SecurityOnline's summary table marks the MessagePack flaw as "Exploited", but the same article's text says only CVE-2026-96951 has confirmed exploitation.14 One widely shared community summary described the zero-days as affecting the Common Log File System driver, Exchange and Print Spooler. That does not match what Microsoft disclosed.12 When a release is this large, inaccurate summaries spread easily, so teams should check against Microsoft's own advisories before reprioritizing.

Critical flaws: Exchange, Active Directory and network services

The critical-severity count also varies. Analytics Insight reports 70, Tenable 69, CrowdStrike 75, Ivanti and Automox 78, and Action1 80.4813 Whichever count is used, remote code execution makes up most of them. Ivanti counted 65 RCEs among its 78 critical CVEs, 34 of them in Office, including 19 in Excel.4 Analytics Insight's breakdown lists 57 RCEs, 11 privilege escalations and two spoofing issues.

Three server-side flaws stand out:

• CVE-2026-70229, an RCE in Active Directory Domain Services rated critical, with a CVSS score of 8.1 and a Microsoft rating of "Exploitation More Likely".2 Lansweeper points out that the targets are domain controllers, where code execution is about as damaging as a compromise gets.10
• CVE-2026-70571, a critical Exchange Server RCE caused by a stack-based buffer overflow.10 Ivanti notes that it affects Exchange 2016 and 2019, whose extended security updates end on October 31.4
• CVE-2026-70279, a cross-site scripting flaw in Exchange that allows spoofing.10 SecurityOnline lists its CVSS score as 9.3.3

SecurityOnline also lists several unauthenticated network RCEs with 9.8 scores. They affect Windows Text Shaping, Windows Error Reporting, Outlook and DNS Server.3 Automox highlighted another Outlook Reading Pane RCE and reported 108 CVEs rated "Exploitation More Likely".8 Ivanti flagged critical bugs in network-facing services including DHCP Server, Message Queuing, Remote Desktop Services and QUIC.4 Action1's same-day list adds a Hyper-V flaw that could let an attacker escape a virtual machine and gain privileges on the host.6

Risk cohorts and support deadlines

Microsoft also changed how it presents the release. It now groups fixes into "risk cohorts", which Analytics Insight described as one of the release's main features. Windows Forum gave a fair assessment. Cohorts reflect how IT teams actually work, since one question about exposure can cover dozens of CVEs. The danger is that teams treat the largest cohorts as the most urgent, which would bury a single-CVE threat like the Shell zero-day.13 The right approach is to use cohorts to schedule work, while exploitation status still decides what gets patched first.

Several support deadlines arrived at the same time. Windows 11 24H2 Home and Pro and Windows 10 Enterprise LTSB 2016 reached end of support.11 Tenable reports that the last year of Extended Security Updates for Windows Server 2012 and 2012 R2 ended on October 13, and that Windows Server 2022 left mainstream support the same day. Windows 10 machines enrolled in extended updates receive these fixes through KB5126657.

A crowded month for edge devices

The Microsoft release also landed during a busy month for attacks on edge infrastructure. Ivanti noted that Citrix disclosed CVE-2026-88779, a NetScaler zero-day, and that CISA flagged an actively exploited critical FortiMail flaw, CVE-2026-104286.4 Ivanti also disclosed CVE-2026-104935, an authentication bypass in Connect Secure, and said it is aware of limited exploitation.4 BleepingComputer added that an Atlassian Data Center flaw was exploited shortly after proof-of-concept code was published.1

Bottom line

The size of this release is real, but it does not tell defenders where the risk is. Tenable's Satnam Narang told CSO Online that vulnerability counts on their own mean very little. This month supports that view. The most urgent flaw is rated only Important, while dozens of Critical RCEs come with no evidence of exploitation.

The sensible order:

1. Patch CVE-2026-96951 everywhere, starting with endpoints that handle email and web content.
2. Fix CVE-2026-108398 wherever WDAC enforcement matters.
3. Patch domain controllers and on-premises Exchange next.
4. Use risk cohorts for the rest, and replace systems that have just lost support.

If monthly releases keep getting bigger as AI-assisted bug finding grows, the pressure on patching teams will grow too. Teams that rank fixes by exploitation status, not by volume, will handle that best.