Microsoft patches record 1,400 flaws in October Patch Tuesday
Microsoft released its largest update batch ever on 13 October, fixing over 1,400 vulnerabilities, with one Windows Shell flaw already under active attack.
Key points
- Microsoft fixed more than 1,400 security flaws in October, surpassing previous monthly and annual records.
- At least 78 vulnerabilities are rated critical, though only one, CVE-2026-96951, is currently being exploited.
- The exploited flaw allows attackers to bypass Mark of the Web protections in the Windows Shell.
Microsoft released more than 1,400 security updates on 13 October, setting a new record for its monthly Patch Tuesday program. According to reporting by The Next Web and Krebs on Security, this volume exceeds the nearly 1,000 flaws patched in September and the 1,261 fixed in all of 2020.
Satnam Narang of Tenable noted that the industry has crossed the 4,000 CVE mark for the year with two months remaining. At least 78 of the vulnerabilities in the October batch are rated critical. Most of these high-severity flaws allow attackers to execute arbitrary code on targeted systems, according to Microsoft’s advisory data.
Active Exploitation and Bypass Techniques
Only one vulnerability from this batch, CVE-2026-96951, is confirmed to be under active exploitation. This flaw resides in the Windows Shell and enables attackers to bypass Mark of the Web, a security label that triggers extra checks for files downloaded from the internet. Microsoft rates this issue as Important with a CVSS score of 8.8, which falls into the high severity range.
Exploiting this flaw requires user interaction. Attackers typically send crafted files via email or instant messaging, or direct victims to malicious websites. The user must open the file for the attack to succeed. The provided update covers Windows 10, Windows 11, Windows Server, and Outlook.com.
Microsoft credited Riku Bamba and Yuya Chudo of Fujitsu and a researcher named yhw for discovering the flaw. The company also acknowledged Benoit Sevens, who used Claude from Anthropic in the research process. Microsoft has not disclosed which threat actors are exploiting the vulnerability or who the specific targets are.
AI Discovery and Patching Priorities
A second vulnerability in the .NET Framework was public before the fix was released, potentially giving attackers more time to develop exploits. However, Microsoft stated it has observed no signs of active attacks against this specific issue yet. The company attributes the surge in discovered bugs to large language models, noting that AI identified the flaws behind July’s record-breaking batch as well.
Bank of America’s chief executive mentioned that 1,000 contractors are currently addressing flaws exposed by AI tools. Security experts warn that such large update batches strain corporate security teams, which often test each patch before deployment. Tyler Reguly of Fortra advised focusing on the 26 Microsoft flaws that have entered the US government’s catalogue of exploited bugs so far this year.
What should you do?
Security leaders should prioritize patching the 26 Microsoft vulnerabilities that are known to be exploited, according to Fortra’s Tyler Reguly. Teams should assess their capacity to handle the volume of updates while ensuring critical systems are protected. Monitoring for user interaction with suspicious files remains essential, as the active Windows Shell flaw relies on victims opening crafted documents.
Background: Large language models
Large language models are a specific type of neural network trained on text. Generative AI is the broader umbrella term for any system that creates new content, including images and code. Not all generative AI uses large language models, but most modern text generators do.
What to do and how to stay safe: Microsoft
- Prioritize applying patches for the 26 Microsoft vulnerabilities listed in the US government’s exploited vulnerabilities catalogue.
- Update Windows 10, Windows 11, Windows Server, and Outlook.com to address CVE-2026-96951 and other October flaws.
- Train users to avoid opening unexpected files or clicking links in emails and instant messages, as the active exploit requires interaction.
- Monitor internal logs for unusual execution patterns following file downloads, particularly those bypassing Mark of the Web protections.
Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many vulnerabilities did Microsoft fix in October?
Microsoft fixed more than 1,400 security flaws in October, which is the largest number for a single Patch Tuesday on record.
Is the Windows Shell vulnerability CVE-2026-96951 being exploited?
Yes, Microsoft confirmed that CVE-2026-96951 is under active exploitation, allowing attackers to bypass Mark of the Web protections.
What role did AI play in finding these vulnerabilities?
Microsoft credited large language models for the increase in discovered bugs, noting AI helped find flaws in previous record-setting months.
