ON 13 October 2026, Dark Reading reports Microsoft’s October Patch Tuesday as the largest update yet, with 1,413 Microsoft CVEs disclosed. The haul includes 80 critical flaws and two zero-day bugs, one of which is actively exploited. The patched issues span Windows, Office, Dev Tools, SharePoint, SQL Server, Exchange, Azure and Defender, with Windows contributing the largest share at 1,102 fixes.
Of particular note is a zero-day in Windows Shell, CVE-2026-96951 (CVSS 8.8), which is under active exploitation, and a second zero-day in .NET Framework Security, CVE-2026-108398, for which exploitation is considered less likely. Microsoft also republished CVE-2026-21413, a raw image extension RCE from Cisco Talos, among the patched items.
The exploited flaw targets the Mark of the Web tag that Windows applies to Internet-downloaded files, bypassing security controls such as SmartScreen, Protected View, the Office macro block, and related prompts. Automox researchers describe it as delivering a file without the “sticker,” undermining multiple defensive checks.
Additional notable vulnerabilities include CVE-2026-70242 (Outlook Reading Pane RCE, CVSS 9.8); CVE-2026-102866 (Office SharePoint elevation of privilege, improper cryptographic signature verification); CVE-2026-65674 (SQL Server deserialization RCE); and CVE-2026-105016 (Microsoft QUIC RCE, CVSS 9.8). Guidance from Nightwing and industry watchers emphasises rapid deployment of Windows, Exchange, and .NET fixes, with particular attention to WDAC environments and externally exposed SQL Server instances.
The piece also notes a broader rise in CVE disclosures, partly AI-assisted, urging prioritisation by exploitability over sheer CVE counts.