Microsoft's October Patch Tuesday tops 1,400 CVEs, with one Windows Shell zero-day under attack

Microsoft's October 2026 security release, published on Patch Tuesday, October 13, is the largest it has ever shipped, and it isn't close. Depending on who is counting, the release covers somewhere between 1,407 and 1,415 CVEs. BleepingComputer counted 1,411, CrowdStrike and Rapid7 1,413, and Trend Micro's Zero Day Initiative (ZDI) 1,415. Every count is well above the previous record, which was set just one month earlier, when September's release came in at roughly 970 CVEs (CrowdStrike counted 972).

Only one of those bugs is under active attack: a Windows Shell flaw that strips the Mark of the Web warning from downloaded files. CISA added it to its Known Exploited Vulnerabilities catalog the same day and gave federal agencies until October 16 to deal with it. Microsoft also used the release to float a new idea for helping admins triage a monthly update this big, which tells you something about how the people shipping these patches see the volume problem.

How big is it, really?

Different trackers disagree on the exact total because they count differently: whether to include third-party components, cloud-only fixes that need no customer action, or CVEs that were republished. The range across reputable sources is narrow, though, and the scale isn't in dispute. Rapid7 says 1,102 of the 1,413 vulnerabilities it counted are in Windows. CrowdStrike, slicing by product family, counts 1,123 Windows patches, 977 for systems covered by Extended Security Updates and 179 for Office. Critical-rated bugs number 70 to 80 depending on the source: BleepingComputer reports 70, CrowdStrike 75 and Dark Reading 80.

ZDI's review puts the number in historical context: "This is also the first four-digit volume we have ever seen and includes six-digit CVEs." By ZDI's count, one month of Microsoft fixes is now larger than any previous full year of them. Its own example is 2023, when Microsoft published 914 CVEs in total.

By CrowdStrike's breakdown, remote code execution is the largest category at 317 patches (22%), followed by information disclosure at 254 (18%). And it wasn't only Microsoft this week. ZDI notes that Adobe released 11 bulletins covering 174 CVEs on the same day, including fixes for ColdFusion, Commerce and Experience Manager.

The one being exploited: CVE-2026-96951

The only vulnerability Microsoft lists as exploited in the wild is CVE-2026-96951, a Windows Shell security feature bypass rated Important with a CVSS score of 8.8. The feature it bypasses is Mark of the Web (MOTW), the tag Windows puts on files that arrive from the internet. Several defenses depend on that tag: SmartScreen warnings for downloaded executables and Office's Protected View for documents, among others. CrowdStrike's analysis puts it plainly: "Once MOTW is stripped, downstream defenses that rely on the zone tag, including SmartScreen, Office Protected View, and Application Guard, no longer apply."

Exploitation still needs a victim. According to Rapid7, a user has to open a specially crafted file or visit an attacker-controlled site. That fits how this class of bug has been used before: phishing campaigns that want their payload to run without a warning dialog appearing first. ZDI points out that attackers have repeatedly found ways around MOTW over the years. Last time it was SmartScreen, and this time it's Shell.

Rapid7 adds some details that matter for patch planning. Windows Server 2012 doesn't get a fix for this bug, but Server 2012 R2 does. The flaw also affected Outlook.com, which Microsoft fixed on the service side in a build dated several weeks ago, so Outlook.com users don't need to do anything. Rapid7 also notes that the advisory credits outside researchers from multiple organizations and none from inside Microsoft.

CISA added CVE-2026-96951 to the KEV catalog on October 13. Its listing calls it a Windows Shell command injection vulnerability (CWE-77) and sets an October 16 due date under Binding Operational Directive 26-04. That leaves federal civilian agencies three days. CISA's entry also marks the flaw for forensic triage, and it lists known use in ransomware campaigns as "Unknown."

Two more zero-days, publicly disclosed but not exploited

Two other bugs were publicly known before the patch shipped. Microsoft has no evidence that either is under attack. CVE-2026-108398 is a .NET Framework security feature bypass (CVSS 8.8) that lets an attacker who already has local, authenticated access register a malicious .NET assembly for loading by a protected process, which gets around Windows Defender Application Control, now called App Control for Business. That requirement for an existing foothold limits who can use it. CrowdStrike argues the bug matters more than its Important rating suggests for organizations that rely on WDAC to lock down admin workstations, kiosks and hardened servers.

The third is CVE-2026-92707, a moderate-severity denial-of-service bug (CVSS 5.3) in MessagePack-CSharp, a widely used .NET serialization library. ZDI notes that it was released by a third party and is now included in Microsoft's release. Because the library ships as a NuGet package rather than as part of Windows, the fix means rebuilding affected applications, not just running Windows Update.

What else deserves attention

In a release this size there are dozens of bugs that would have led the coverage a few years ago. A few groups stand out across the vendor write-ups:

Preview-pane bugs in Office and Outlook. CrowdStrike counts 23 CVEs across Office apps, including Excel, PowerPoint and Visio, that can be triggered just by previewing a malicious file. Rapid7 separately flags five Outlook remote code execution bugs where the reading pane is a vector, "meaning that simply scrolling past an email in the Outlook reading pane would be sufficient to trigger exploitation." It points to CVE-2023-23397, a no-interaction Outlook flaw used in state-backed campaigns, as a reminder of how this kind of bug tends to get used.

Unauthenticated network RCEs. CrowdStrike identifies 15 CVEs that let a remote attacker run code without logging in, in DHCP Server, Microsoft's QUIC implementation, the PostScript printer driver and PDF handling. ZDI uses a broader definition and counts 59 CVEs in the release that it considers potentially wormable, while cautioning that some of the descriptions are ambiguous.

Identity infrastructure. Both CrowdStrike and ZDI highlight bugs in Active Directory Domain Services, including an RCE against domain controllers, and spoofing bugs in AD FS. ZDI also calls out a Critical SharePoint elevation-of-privilege flaw (CVSS 8.1). It is the only Critical SharePoint bug this month and the only one an unauthenticated attacker can exploit, by tampering with a stolen proof token. ZDI also flags a SQL Server deserialization RCE (CVSS 8.8) that is worth checking on any internet-facing SQL Server.

Why the numbers keep climbing

The usual explanation is AI-assisted vulnerability discovery. Computer Weekly's coverage attributes the record largely to it, and ZDI agrees, with a caveat: "AI isn't creating these bugs out of thin air. It's just shortening the time between a vulnerability existing and someone noticing it." ZDI's point is that discovery is growing much faster than exploitation. By its count, Microsoft has had 15 zero-days from January through October this year, compared with 17 over the same period of 2023, when the full-year CVE total was under a thousand.

ZDI's practical advice follows from that. Teams that "triage by sheer CVE count instead of exploitability are burning cycles on the wrong bugs." Rapid7 expects the trend to continue, writing that "there is every reason to suppose that vulnerability volumes will continue to rise."

Microsoft's answer: "risk cohorts"

Microsoft seems to see the same problem. Alongside the release, the Microsoft Security Response Center published a blog post introducing what it calls risk cohorts: groups of CVEs that call for the same assessment of a customer's environment, even when they don't share a root cause or a severity score. One example groups 64 RDP-related CVEs around a single question: "which client, gateway, and server roles are deployed and exposed?" Another puts 119 Office CVEs (23 of them Critical, 17 needing no user interaction) behind the question of which users and machines handle untrusted documents or mail.

Microsoft is careful about what this is. Per the MSRC post, cohorts "are not official Microsoft vulnerability categories, do not change Microsoft update guidance, and do not replace the assessment of individual CVEs." The company says it is "not announcing a new Microsoft vulnerability classification or prioritization framework," and that the Security Update Guide doesn't show these groupings yet. ZDI welcomed the idea and pointed out that it looks a lot like the old per-component security bulletins Microsoft dropped years ago.

Rapid7 raises one transparency complaint. Recent Edge release notes say "CVE's will be added as soon as available," but at the time of its writeup the Security Update Guide listed zero Edge vulnerabilities for the first 13 days of October. As a result, according to Rapid7, defenders have no obvious way of knowing which Chromium fixes have reached Edge.

Lifecycle deadlines landing this week

The patches arrive alongside several end-of-support dates. Rapid7 notes that the third and final year of Extended Security Updates for Windows Server 2012 and 2012 R2 ends on October 14, 2026, per Microsoft's lifecycle listings. Office 2021 also retires this week, and Rapid7 says Exchange Server 2016 and 2019 are now out of extended support for good after two earlier six-month reprieves, so future Exchange advisories will stop listing them. That doesn't mean those versions stop being vulnerable, only that Microsoft stops saying so.

For most organizations the order is clear: deploy the Windows Shell fix now, then work through the Office, Outlook, network-service and identity bugs by exposure. Microsoft's own cohort experiment is one way to organize that second pass. The harder question is how long a monthly release this size stays workable. Microsoft has now set a record two months running and shows no sign of slowing down.