Press play to start listening
Microsoft addressed 1,413 security vulnerabilities in its October 2026 Patch Tuesday update, making it the company’s largest monthly security release to date.
Microsoft addressed 1,413 security flaws on October 13, 2026, marking its largest security update to date. Reportedly, artificial Intelligence-based automated scanning systems helped identify some of the security vulnerabilities fixed this month, pushing the total far past previous monthly releases. But it’s unclear how much AI contributed to this month’s fixes.
The October Patch Tuesday update covers 1,102 flaws in Windows components, 134 in Office applications, 61 across developer tools, 36 in SharePoint Server, 22 in SQL Server, 15 in Azure, and seven in Exchange Server, according to one breakdown.
Actively Exploited Zero-Day Bypasses Windows Protection
The most pressing threat patched is CVE-2026-96951, a zero-day flaw in Windows Shell carrying a CVSS score of 8.8. Microsoft confirmed that attackers are actively exploiting the vulnerability. The flaw targets command execution logic in Windows Shell and can allow attackers to bypass Mark of the Web (MOTW).
Under normal conditions, Windows attaches an MOTW marker to files downloaded from the internet. Security features, including SmartScreen, Office Protected View and Smart App Control on Windows 11, use this marker to help restrict possibly dangerous files.
But by exploiting the flaw attackers can get malicious files to evade checks that rely on MOTW, potentially allowing them to open without the usual warnings or restrictions. Reports have linked the vulnerability’s discovery to Anthropic’s Claude AI, although public details about the attacks remain limited.
Two other publicly disclosed vulnerabilities were also addressed:
- CVE-2026-108398 (CVSS 8.8): A .NET Framework security feature bypass flaw involving an untrusted search path. An authenticated attacker could load a specially crafted assembly into a protected process and bypass Windows Defender Application Control (WDAC).
- CVE-2026-92707: A MessagePack-CSharp denial-of-service vulnerability involving uncontrolled memory allocation that could allow a remote attacker to disrupt a service.
Outlook and Other Microsoft Products at Risk
Several other vulnerabilities also need attention. CVE-2026-70242 (CVSS 9.8) affects MS Outlook and can trigger a heap-based buffer overflow when a specially crafted email appears in the Reading Pane. The issue potentially allows code execution without the recipient clicking a link or opening the message separately.
Microsoft QUIC is affected by CVE-2026-105016, also rated 9.8, and could let an unauthenticated attacker run code remotely by sending specially crafted network packets to an affected service.
SharePoint Server users should also check CVE-2026-102866 that involves cryptographic token verification and could allow an attacker to impersonate a targeted user. Another one is CVE-2026-65674 that affects SQL Server. An authenticated attacker could exploit its handling of untrusted data by sending a specially crafted request to execute code on the server.
The update also brings an end to security updates for Windows 11 version 24H2 Home and Pro editions and Windows 10 Enterprise LTSB 2016. Systems running these editions will no longer receive routine security fixes, making migration to supported versions an important consideration.
Microsoft’s October update is unusually large, but the size of the release also shows how automated and AI-assisted scanning can increase the number of vulnerabilities found and fixed. For users and organizations running Windows or other Microsoft products, applying the latest security updates should be a priority.
Expert’s Commentary:
Commenting on Microsoft’s October Patch Tuesday update, Tyler Reguly, Associate Director of Security R&D at Fortra, told Hackread.com that the number of vulnerabilities disclosed matters less than identifying which ones organizations need to address first.
“Recently, I’ve argued that numbers are meaningless. This month’s number, 1413, is no different. There are, however, numbers that hold meaning. 26, for example, is how many 2026 Microsoft CVEs have shown up in the CISA KEV,” Reguly said. He noted that the figure was 30 last year and 32 the year before, adding that “less than 1% of vulnerabilities patched by Microsoft this year are known to be exploited.”
Reguly compared vulnerability prioritization to choosing what to watch from a large streaming catalog, arguing that security teams should focus on vulnerabilities that matter most to their organizations rather than treating every disclosure with equal urgency.
“You don’t need to care about every vulnerability, just the one you are going to patch next, which you prioritize based on factors that matter to your organization,” he said. “The rest of the vulnerabilities… background noise.”
Action1’s research, shared with Hackread.com, also highlights the challenge of deciding which patches to deploy first. Alongside the actively exploited Windows Shell flaw, administrators should assess risks affecting identity and network services, as well as Exchange, SharePoint and Hyper-V. Action1 recommends prioritizing updates based on active exploitation, exposure and each system’s role in the organization rather than relying on severity scores alone.
Action1 researchers also shared their comments with Hackread.com, highlighting the record number of patches and the risks posed by several vulnerabilities.
Jack Bicer, Director of Vulnerability Research at Action1, noted that October’s update broke the previous month’s record. “Just one month after Microsoft delivered the largest Patch Tuesday we had ever seen, October has shattered that record again,” he said, pointing to 1,409 patches, 80 critical vulnerabilities and two zero-days.
On the actively exploited Windows Shell flaw, CVE-2026-96951, Bicer warned that it allows attackers to “evade Microsoft’s Mark of the Web (MOTW) protections.” He said organizations should prioritize updates for systems frequently exposed to untrusted files and external communications.
