Microsoft October Patch Tuesday Fixes Record 1,413 Flaws, Including Exploited Zero-Day

Microsoft released its October 2026 Patch Tuesday updates on October 13, addressing a record-breaking 1,413 vulnerabilities across its software portfolio. According to analysis by CrowdStrike, this massive release includes 75 critical flaws and three zero-day vulnerabilities, one of which is already being actively exploited by attackers in the wild.

The most urgent issue is CVE-2026-96951, a Windows Shell security feature bypass vulnerability with a CVSS score of 8.8. This flaw allows attackers to bypass the Mark of the Web defense, which normally warns users about potentially unsafe downloaded files. Successful exploitation requires user interaction, such as clicking a link or opening an attachment in an email or instant message.

Context and Background

Microsoft stated that its growing use of artificial intelligence to find and fix security vulnerabilities means users should expect more fixes in its monthly updates. While CrowdStrike counted 1,413 vulnerabilities, BleepingComputer reported slightly different figures, counting 1,411 vulnerabilities including 70 critical flaws. These discrepancies reflect variations in which vulnerabilities and updates researchers include in their Patch Tuesday totals.

The release includes KB5101684, a preview update delivering 42 fixes for Windows 11 versions 24H2 and 25H2. CrowdStrike identified elevation of privilege, remote code execution, and information disclosure as the most common vulnerability categories in this release. Specifically, 677 flaws allow privilege elevation, 317 allow remote code execution, and 254 allow information disclosure.

Who Is Affected

Two other zero-day vulnerabilities were publicly disclosed before fixes became available. CVE-2026-108398, with a CVSS score of 8.8, involves an untrusted search path in .NET Framework. This allows an authorized attacker to bypass Windows Defender Application Control locally, potentially running unauthorized applications on target systems.

Another publicly disclosed flaw is CVE-2026-92707, rated 5.3 on the CVSS scale. This vulnerability allows an unauthenticated remote attacker to exhaust memory in affected applications that process specially crafted MessagePack data. Exposure depends on how a service uses the MessagePack-CSharp library to pack and unpack information efficiently.

What should you do?

IT administrators should prioritize patching the Windows Shell vulnerability immediately due to active exploitation. Users can apply these updates by selecting Windows Update from the start menu, clicking "Check for updates," and installing any available patches. A restart may be required to complete the installation. After restarting, users should verify the system reports it is up to date.

What to do and how to stay safe: Microsoft

• Check Windows Update settings to ensure automatic security updates are enabled for all supported devices.
• Monitor email and instant messages for suspicious attachments or links that could exploit the Windows Shell flaw.
• Verify that Windows Defender Application Control policies are enforced to mitigate risks from local privilege escalation.
• Review applications using MessagePack-CSharp libraries to ensure they validate input data correctly.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is the exploited Windows Shell vulnerability being used in the wild?

Yes, CVE-2026-96951 is an actively exploited vulnerability that bypasses the Mark of the Web defense.

How many vulnerabilities did Microsoft fix in October 2026?

Microsoft addressed a record 1,413 vulnerabilities in its October 2026 Patch Tuesday release.

What is the CVSS score for the .NET Framework zero-day?

CVE-2026-108398 has a CVSS score of 8.8 out of 10.