Microsoft’s October 2026 security release, shipped on Tuesday, fixes 1,413 vulnerabilities across Windows, Office and its other products — the largest Patch Tuesday in the company’s history. Buried in that record pile is the one flaw that cannot wait: a Windows Shell vulnerability, tracked as CVE-2026-96951, that Microsoft confirms was already being exploited before a fix existed. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalog the same day and gave federal agencies until October 16 to patch it.
A record that keeps breaking
The scale is difficult to overstate. According to SecurityWeek’s tally of Microsoft’s release data, 1,102 of the flaws affect Windows, 134 affect Office, 61 affect developer tools and 36 affect SharePoint Server, with Exchange Server, SQL Server, Azure and Defender also receiving fixes. Just a month earlier, September’s release of nearly 1,000 fixes had set the previous record.
Tenable’s Satnam Narang noted, in figures reported by KrebsOnSecurity, that this single month exceeds the 1,261 vulnerabilities Microsoft patched in all of 2020, and that the company’s 2026 total has now passed 4,000 with two months still to go. SecurityWeek attributes the surge largely to artificial intelligence: Microsoft is increasingly using AI systems to find and fix bugs in its own code, and the machines are finding more than human reviewers used to.
Exact totals vary slightly by methodology — BleepingComputer counted 1,411 flaws fixed on the day itself, and some tallies reach 1,414 or 1,415 depending on which products they include. By type, BleepingComputer’s breakdown counts 677 elevation-of-privilege flaws, 317 remote code execution flaws, 254 information disclosures, 73 denial-of-service flaws, 40 security feature bypasses and 28 spoofing flaws.
The exploited one: a Windows Shell bypass
CVE-2026-96951 is a command injection flaw in Windows Shell, rated 8.8 out of 10 in severity. It lets an unauthorized attacker bypass Mark of the Web, the tag Windows attaches to files that arrive from the internet or by email. That tag is what triggers SmartScreen warnings and Office’s Protected View; a file that slips past it can open as if the user had created it locally, with none of the usual friction.
Microsoft’s advisory describes an email or instant-message scenario in which an attacker sends a specially crafted file designed to exploit the flaw. The attack is not zero-click: the company notes that an attacker “would have no way to force a user to view attacker-controlled content” and would instead have to convince the user to take action. That still leaves a wide field — a convincing attachment is the oldest trick in phishing — which is why CISA’s three-day federal deadline is unusually urgent.
The flaw was reported to Microsoft independently by researchers at Fujitsu and Anthropic and by an independent expert, according to SecurityWeek. Microsoft has not shared details about who exploited it or how the attacks unfolded.
Two more zero-days, disclosed but not exploited
Two other flaws were publicly known before fixes arrived. CVE-2026-108398, a .NET Framework vulnerability found by James Forshaw of Google Project Zero, could let an authenticated attacker bypass Windows Defender Application Control restrictions and run code inside a protected process. CVE-2026-92707 is a denial-of-service flaw in the MessagePack-CSharp library, caused by uncontrolled memory allocation. Neither has confirmed exploitation, but both were public before Patch Tuesday, which compresses the safe patching window.
What to do with 1,413 fixes
No IT team can test 1,413 patches at once, and Microsoft knows it: this month it introduced “risk cohorts,” a way of grouping flaws by shared risk questions so teams can triage the exceptions first. The practical order is clear enough. CVE-2026-96951 goes first, everywhere, ahead of CISA’s October 16 deadline — a bypass of the warning layer users rely on is exactly the kind of flaw that turns one careless click into a compromise.
The broader lesson is the familiar one, at unfamiliar scale. Attackers consistently reach for whatever users and admins have not yet patched — the same dynamic behind attacks on outdated desktop apps. A record Patch Tuesday is, in the end, a record to-do list, and the exploited item on it has a deadline measured in days.
