Microsoft Patches Record 1,413 Vulnerabilities in October Update, Including Exploited Windows Zero-Day
Microsoft's October security update fixes a record 1,413 vulnerabilities, including a Windows zero-day already being exploited in attacks. Federal agencies must patch the flaw by October 16.
Microsoft released fixes for 1,413 security vulnerabilities on Tuesday, the largest monthly security update in the company’s history, including a Windows flaw that attackers are already exploiting.
The October update addresses 1,102 vulnerabilities in Windows, 134 in Office, 61 in developer tools, and 36 in SharePoint Server, according to SecurityWeek. Exchange Server, Azure, Defender, and other products received fixes as well. Microsoft patched more flaws in October than it did in all of 2025, pushing its 2026 total past 4,000. The surge is largely driven by the company’s use of AI to find vulnerabilities in its own products.
Exploited zero-day in Windows Shell
The most urgent fix covers CVE-2026-96951, a Windows Shell flaw that Microsoft confirmed is being exploited in the wild. With a severity score of 8.8 out of 10, the vulnerability lets attackers bypass Windows’ Mark of the Web defenses, which tag files downloaded from the internet so that tools like Defender SmartScreen and Office Protected View restrict them from running automatically. Microsoft said an attacker would need to trick a user into opening a crafted file sent by email or instant message. The flaw was reported independently by researchers at Fujitsu, Anthropic, and an independent expert.
The U.S. Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog on Tuesday and ordered federal agencies to apply the fix by October 16.
Two more zero-days and a bigger patching burden
Two other zero-days were publicly disclosed before Microsoft released fixes. One, CVE-2026-108398, lets attackers bypass Windows Defender Application Control enforcement, which restricts which applications can run on a system. Microsoft said it does not believe that flaw is being exploited. The other, CVE-2026-92707, is a denial-of-service vulnerability in the MessagePack-CSharp component used in Visual Studio and .NET. Microsoft has not assessed whether it is being exploited.
To help IT teams sort through the volume, Microsoft introduced “risk cohorts,” groups of vulnerabilities that require a similar customer assessment even when they share no root cause or severity score. The company said the cohorts are a starting point and that customers should still review each vulnerability for active exploitation, severity, attack vector, user interaction, and product-specific guidance.
Reporting based on coverage by SecurityWeek.
