Microsoft patches record 1,411 flaws in October 2026 Patch Tuesday, including actively exploited Windows Shell zero-day

Microsoft released its October 2026 Patch Tuesday security updates on October 13, fixing a record-breaking 1,411 vulnerabilities across Windows, Azure, and .NET — the largest single monthly patch release the company has ever issued. The update includes three zero-day vulnerabilities, one of which is already being actively exploited in the wild.

The sheer scale of October’s release reflects a deliberate shift in how Microsoft finds bugs. The company has credited its expanded use of AI-assisted vulnerability scanning tools with identifying a significantly higher number of security flaws before attackers can find them first — a strategy that inflates the patch count but shrinks the attack surface.

The actively exploited zero-day, tracked as CVE-2026-96951, is a security feature bypass in Windows Shell that allows attackers to circumvent the Mark of the Web (MotW) protection. MotW is the mechanism Windows uses to flag files downloaded from the internet as potentially unsafe, triggering additional warnings before execution. Attackers exploiting this bypass can execute downloaded files without those warnings, making it a reliable tool for phishing and malware delivery campaigns. Microsoft has not disclosed how the vulnerability is being used in attacks or who discovered it.

Two additional zero-days were publicly disclosed before patches were available, though neither has been seen exploited yet. CVE-2026-108398, discovered by Google Project Zero researcher James Forshaw, allows an attacker to bypass Windows Defender Application Control (WDAC), potentially running unauthorized code in a protected process. The third, CVE-2026-92707, is a moderate-severity denial-of-service flaw in MessagePack-CSharp, a widely used .NET serialization library.

Among the 70 critical-severity vulnerabilities patched this month, the most significant include a remote code execution flaw in Windows Active Directory Domain Services (CVE-2026-70229), two spoofing vulnerabilities in Active Directory Federation Services, a remote code execution bug in Azure App Service (CVE-2026-77900), and an elevation-of-privilege flaw in the Linux Kernel running under Azure (CVE-2026-62840). The severity breakdown shows 317 remote code execution flaws, 677 elevation-of-privilege bugs, 254 information disclosure vulnerabilities, and 40 security feature bypasses.

Security teams running Windows environments should prioritize patching CVE-2026-96951 immediately given its active exploitation status. Organizations relying on WDAC as a security boundary should treat CVE-2026-108398 as urgent given its public disclosure. Azure-hosted workloads should assess the App Service and Event Grid patches for any internet-facing services.

As first reported by BleepingComputer, the October count also excludes 348 vulnerabilities Microsoft resolved outside of Patch Tuesday earlier in the month, putting the true monthly total closer to 1,759 flaws addressed in October alone.