MICROSOFT has released its October 2026 Patch Tuesday with a record 1,413 CVE fixes across multiple products, including Windows, Office, developer tools, and SharePoint Server. Microsoft notes that 1,102 of the fixes affect Windows, with additional patches for 134 Office vulnerabilities, 61 in developer tools, and 36 in SharePoint Server. The patch batch also covers Exchange Server and Defender, among other products, and the overall number of fixed flaws in 2026 has now surpassed 4,000. The drive behind the surge is linked in part to AI-driven vulnerability discovery and exploitation.
The most significant item cited is CVE-2026-96951, a Windows shell security feature bypass that enables an attacker to evade Mark of the Web protections. Microsoft describes MotW as gating automatic execution for internet-downloaded files, with bypass allowing malicious files to run without warning. The vulnerability has been exploited in the wild, and CISA added CVE-2026-96951 to its Known Exploited Vulnerabilities catalog, with agencies told to remediate by 16 October.
Two other vulnerabilities disclosed publicly prior to the fixes are highlighted: CVE-2026-108398, a WDAC enforcement bypass that Microsoft regards as unlikely to be exploited, and CVE-2026-92707, a DoS flaw in the MessagePack-CSharp component used by Visual Studio and .NET, for which exploitability has not been assessed.
Microsoft also announced “risk cohorts” to help users prioritise updates, while emphasising that prioritisation should continue to consider exploitation activity, severity, and guidance for each CVE.