Microsoft Releases 1,413 Patches for October 2026, Including Three Zero-Day Flaws
Microsoft’s October 2026 update addresses 1,413 vulnerabilities, including three zero-days, with one Windows Shell flaw already exploited in the wild.
Key points
- Microsoft published patches for 1,413 vulnerabilities in October 2026, including 1,102 for Windows.
- One zero-day in the Windows Shell (CVE-2026-96951) is being exploited in the wild.
- Two other vulnerabilities have been publicly disclosed, including a .NET Framework bypass.
Microsoft released patches for 1,413 vulnerabilities on October 13, 2026, in an update described as much bigger than the previous month's record-setting release. The update includes fixes for 1,102 flaws in Windows products, with security researchers noting a continued upward trend in vulnerability volumes throughout 2026.
The update addresses three zero-day vulnerabilities, one of which is already being exploited in the wild. According to Rapid7, Microsoft confirmed active exploitation for only one of the newly patched flaws, while two others have seen public disclosure. The sheer volume of fixes highlights the increasing complexity of securing modern software ecosystems.
Critical Zero-Day Details
The most significant flaw, CVE-2026-96951, affects the Windows Shell, which handles GUI interactions via explorer.exe. This is the second exploited-in-the-wild zero-day targeting the Windows Shell this year. Attackers use this vulnerability to bypass the Mark of the Web (MOTW) security feature, preventing Windows from warning users about potentially harmful files.
Exploitation requires a user to open a specially crafted malicious file or visit an attacker-controlled website. While the patch addresses the vulnerability, users must still exercise caution when interacting with unknown files or links. Windows Server 2012 does not receive a patch for this issue, though Server 2012 R2 is supported.
Additional Vulnerabilities and Context
Microsoft also addressed CVE-2026-108398, a security feature bypass in the .NET Framework that has been publicly disclosed. This flaw allows attackers with an existing foothold to register malicious .NET assemblies, bypassing Windows Defender Application Control (WDAC) enforcement. The patch presumably removes an attacker-controlled location from the list of places .NET Framework searches for registered assemblies.
This is only the second month Microsoft has published vulnerabilities with six-digit CVE numbers, signaling a rapid increase in industry-wide vulnerability discovery. The advisory acknowledges reporters from multiple external organizations, with no internal Microsoft staff credited for the findings. Outlook.com cloud services were also affected by the Windows Shell flaw but were patched in a build released several weeks prior.
What should you do?
Organizations should prioritize patching systems immediately, especially those running Windows Server 2012 R2 and later. Users should remain vigilant against malicious files and links, as the zero-day exploitation requires user interaction. Security teams should monitor for signs of WDAC bypass attempts, particularly on systems with existing compromises.
What to do and how to stay safe
- Apply the October 2026 security updates to all supported Windows systems as soon as possible.
- Verify that Windows Server 2012 systems are isolated or upgraded, as they do not receive patches for the Windows Shell flaw.
- Monitor network traffic and endpoint logs for indicators of MOTW bypass attempts or unauthorized .NET assembly loading.
- Educate users to avoid opening unexpected
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
