Patch Tuesday Record: Microsoft Fixes 1,413 Flaws, One Zero-Day

A release larger than any previous year

Microsoft's October 2026 Patch Tuesday, released on October 13, fixed 1,413 CVEs. That is the largest single release in the program's history, and Windows alone accounts for 1,102 of the fixes115. The rest of the count, as reported, includes 134 Office bugs, 61 in developer tools, 36 in SharePoint Server, and 22 in SQL Server, with Exchange Server, Azure and Defender adding smaller batches515.

For scale, the record for an entire year was 1,261 CVEs, set in 2020, and this one monthly release passed it12. It also comes one month after September's release, which fixed more than 970 vulnerabilities and two actively exploited zero-days13. Tenable called October the second month in a row to set a new Patch Tuesday record.

By type, the reported totals are 677 elevation-of-privilege flaws, 317 remote code execution bugs and 254 information-disclosure issues13. Privilege escalation leads the list by a wide margin. These bugs let an attacker who already has a foothold gain more control, which makes them central to how intrusions spread once an attacker is inside a network.

The zero-day that matters: CVE-2026-96951

One flaw has a confirmed exploit in the wild. CVE-2026-96951 is a Windows Shell security feature bypass rated 8.8 on CVSS, and it lets attackers get around Mark of the Web (MotW)11. MotW is the hidden tag Windows puts on files that come from the internet. SmartScreen and Office Protected View check that tag before deciding whether to block or sandbox a file. If the tag is missing, a malicious file can open with no warning at all11.

One research team summed up the danger well: a file without the tag opens as if the user had created it locally. That means no warning dialog, no read-only view and no macro blocking, so a single flaw disables several defenses at once15. The attacker still has to get the victim to open a crafted file or visit an attacker-controlled resource13. That requirement fits ordinary phishing campaigns, which is why it offers little comfort.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the bug to its Known Exploited Vulnerabilities (KEV) catalog on Tuesday. Federal agencies must fix it by October 16, roughly three business days113. Ivanti's analysis says the flaw affects Windows 10, Windows 11, and Windows Server 2012 R2 through 2025.

Microsoft has not said who is exploiting the flaw, how, or against whom513. SecurityWeek notes that attackers regularly use MotW bypasses of this kind in their campaigns11. Tenable's Satnam Narang says this is the third Windows Shell flaw exploited in the wild this year12. In this analysis, that pattern matters more than the headline number: attackers keep finding ways through the same part of Windows that is supposed to warn users about untrusted files.

The flaw's rating is also a problem. Microsoft rates CVE-2026-96951 "important" rather than "critical," and some researchers say that label understates the risk of a bug already in use2. Several outlets point out that its 8.8 score is lower than other flaws in the same release, including a 9.3-rated Exchange spoofing bug, yet this is the one being exploited2. Teams that rank patches by CVSS score alone would have put it lower on the list.

Where the reporting diverges

The coverage agrees on the core facts but differs on several details.

The totals. CrowdStrike's count is 1,413 CVEs with 75 critical, BleepingComputer counted 1,411 with 70 critical, and Tenable counted 1,407 with 69 critical13. Ivanti also gives 1,407 but lists 78 critical fixes. Cybernews reported 78 critical bugs alongside the 1,413 figure6. These gaps come from what each firm includes, such as third-party CVEs bundled into the release13. They are not a real disagreement about the risk.

The second and third zero-days. Everyone agrees that CVE-2026-108398 was publicly disclosed before a fix shipped. It is a .NET Framework untrusted search path flaw that lets an attacker load a crafted assembly into a protected process and get around Windows Defender Application Control515. The third disclosed bug is where outlets split. The Hacker News, TechRepublic and BigGo name CVE-2026-92707, a denial-of-service flaw in MessagePack-CSharp rated 5.35134. Shattered.io, citing CSO Online, names CVE-2026-102866 instead, a SharePoint token validation flaw that could allow account takeover without authentication2. Tenable's own write-up counts only two zero-days in total. The best reading of these reports is that the MessagePack bug is the official third disclosed zero-day, while the SharePoint flaw is serious but has a disputed label.

How many are actually exploited. At least one commentary site said all three zero-days were "actively exploited"7. The rest of the coverage contradicts that. Only CVE-2026-96951 has confirmed exploitation, and neither disclosed flaw had been seen in attacks when the patches came out135.

Who found the bug. SecurityWeek says Fujitsu, Anthropic and an independent researcher each reported the Shell flaw separately11. Dark Reading goes further and says Anthropic's Claude AI found it15. The Hacker News credits James Forshaw of Google Project Zero for a discovery in the release5.

AI and the growing CVE count

The AI credit points to the likely cause of the record. Dark Reading frames the release as part of an AI-driven "vulnpocalypse era"15. Tech Times reports that Microsoft is running AI tools across its own code, turning up old bugs that human reviewers missed for years. Under that reading, the higher counts reflect faster bug-finding, not software that suddenly got worse.

The exploitation data supports that view. Fortra's Tyler Reguly argues the raw totals are close to meaningless. A more useful figure, he says, is that 26 Microsoft CVEs from 2026 have reached CISA's KEV catalog so far, compared with 30 last year and 32 the year before9. (Shattered.io attributes the same point to Narang2.) Tech Insider reports that Microsoft has disclosed 15 exploited zero-days from January through October 2026, slightly fewer than the 17 in the same period of 202314. Patch volume is rising while confirmed exploitation stays flat or falls.

This is the most important point for anyone trying to understand the threat landscape. The record number is real, but it mostly measures discovery. The risk is concentrated in a small number of bugs, and right now the main one is a phishing-friendly bypass of the warnings users depend on.

Outlook, Exchange and the rest of the priority list

Several other fixes stand out. TechRepublic, citing CrowdStrike, reports Outlook flaws that need no login and no user action: a crafted email could run code as soon as it appears in the Reading Pane. It also counts 23 Office vulnerabilities that can be triggered through file previews13. Tech Times counts five such Outlook remote code execution bugs.

Tenable singled out an Active Directory Domain Services remote code execution flaw, CVE-2026-70229 (CVSS 8.1). It also flagged two Exchange bugs: CVE-2026-70279, a 9.3-rated spoofing flaw, and CVE-2026-70571, a remote code execution bug triggered when the server processes a malicious email. Microsoft rates all three as "Exploitation More Likely"2. The release also includes a fix for a non-Microsoft heap overflow in Raw Image Extension, CVE-2026-21413, rated 9.85.

Microsoft is also testing "risk cohorts." These group related fixes to help administrators sort releases this large6. Microsoft stresses that the groupings are experimental, are not a new official classification, and do not change its patching guidance13. Treated as a sorting aid rather than guidance, the cohorts look like an admission that monthly releases have outgrown how most teams triage them.

Edge devices, end of support and the wider picture

The release landed in a busy month. Ivanti's own guidance points to attacks on network edge devices in the run-up to Patch Tuesday, including a targeted Citrix NetScaler zero-day and an exploited FortiMail flaw rated 9.8. Several outlets also mention a chained Ivanti Connect Secure zero-day23. Product support deadlines add pressure. Windows 11 24H2 Home and Pro stopped receiving updates4, and Tech Times reports that Windows Server 2012 and 2012 R2 used up their Extended Security Update coverage. Machines that miss this cycle may have no route to future fixes.

The human side of security made news alongside the patches. One Danish commentary tied the release to a national identity data breach that reportedly began with an IT company's admin account protected by the password "123456"8. The two stories differ, but the lesson is the same: attackers go for the weakest link, whether that is a reused password or a missing file warning.

The verdict

The 1,413 total will get the headlines, but it is the wrong number to focus on. The figures that matter are one confirmed exploit, a three-day federal deadline, and a third Windows Shell zero-day this year. Organizations should patch CVE-2026-96951 first. Next come the publicly disclosed .NET bypass and the Outlook preview-pane bugs that need no clicks, followed by Exchange and Active Directory. The rest can go through the normal patch cycle. If AI-assisted bug hunting keeps growing release sizes, the security teams that cope best will be the ones ranking patches by evidence of exploitation rather than by the size of the count.