# Microsoft fixed 1,413 bugs in one go, including one under attack

> Microsoft's October 2026 Patch Tuesday fixed a record-breaking 1,413 flaws, including a Windows zero-day already being exploited in the wild.

- Published: 2026-10-15
- Topic: [Security](https://futuretechnologyhq.com/topic/security/)
- URL: https://futuretechnologyhq.com/article/microsoft-record-patch-tuesday-1413-cves-october-2026/
- Publisher: [Future Technology](https://futuretechnologyhq.com/), free to read. Quote as "Future Technology" with a link to the article.

## Key points

- October 2026 Patch Tuesday fixed 1,413 CVEs, a record-breaking release, with 1,102 of them in Windows.
- CVE-2026-96951 (CVSS 8.8) bypasses Mark of the Web and is already exploited in the wild; CISA added it to its known exploited list with a 16 October deadline for US federal agencies.
- Install Windows and Office updates now and treat unexpected attachments with suspicion.

## Article

Microsoft fixed 1,413 vulnerabilities in its October 2026 Patch Tuesday, a record-breaking release. This month alone exceeds Microsoft's entire 2025 total. SecurityWeek reports that vulnerabilities patched so far in 2026 now top 4,000, a surge largely driven by AI.

## What is in the October 2026 Patch Tuesday

Windows takes the largest share: 1,102 of the 1,413 CVEs. Office has 134, developer tools 61 and SharePoint Server 36. Exchange Server, Azure and Defender also received security patches.

## The flaw already being used in attacks

CVE-2026-96951, a Windows shell security feature bypass flaw with a CVSS score of 8.8, is the most important. It enables attackers to evade Mark of the Web (MotW) defences. MotW tags files downloaded from the internet, signalling security mechanisms like Defender SmartScreen and Office Protected View to restrict automatic execution. Bypassing MotW allows malicious files to launch without triggering warnings.

According to Microsoft, an attacker could send a specially crafted file by email or instant message, but would need to convince the user to open it. The flaw has been exploited in the wild.

CISA added CVE-2026-96951 to its known exploited vulnerabilities catalogue on Tuesday and instructed US federal agencies to address it by 16 October. Researchers at Fujitsu, Anthropic and an independent expert independently reported the issue.

## Why the number is so large

The surge in vulnerabilities is largely driven by AI. Two other newly patched flaws were publicly disclosed before Microsoft released fixes. CVE-2026-108398 allows an attacker to bypass Windows Defender Application Control (WDAC) enforcement; Microsoft considers this unlikely to be exploited. CVE-2026-92707 is a denial of service vulnerability affecting the MessagePack-CSharp component in Visual Studio and .NET.

Microsoft also announced risk cohorts to help users prioritise security updates. A risk cohort is a group of CVEs that require similar customer assessment. Microsoft emphasised that risk cohorts are a starting point, not a final decision, and customers should continue to review each CVE for active exploitation, severity, attack vector, user interaction and product-specific guidance.

## What to do today

Until that is done, treat unexpected attachments with suspicion, since this bug can bypass the usual warning when files are opened.

## Sources

- [413 vulnerabilities including exploited Windows zero-day (SecurityWeek)](https://www.securityweek.com/microsoft-patches-record-1413-vulnerabilities-including-exploited-windows-zero-day/)
- [Known Exploited Vulnerabilities Catalog (CISA)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [YubiKey 5 NFC on Amazon (affiliate link)](https://www.amazon.co.uk/dp/B07HBD71HL?tag=futuretech0d6-21)