MICROSOFT’S October Patch Tuesday set a new record, fixing 1,411 CVEs and surpassing the total patched in the whole of 2025. The surge is attributed to Microsoft leveraging AI-assisted vulnerability discovery and remediation through its multi-model agentic scanning harness (MDASH). The October haul includes a publicly disclosed zero‑day and an actively exploited vulnerability, underscoring the increasing workload for security teams and the ongoing pressure to keep enterprise environments patched.
Socura’s latest UK CISOs survey echoed this strain, revealing that around 22% of CISOs reported taking time off or calling in sick to cope with Patch Tuesday stress.
The most notable entries include one actively exploited CVE and two publicly disclosed zero days. CVE-2026-96951 is a Windows Shell security feature bypass with a CVSS of 8.8, enabling malware exposure, data compromise, system integrity violations and operational disruption. It requires no authentication or privileges and can be triggered by user interaction via crafted files delivered through phishing emails, instant messages, or malicious websites.
CVE-2026-108398 is a .NET framework security feature bypass that could allow authenticated, low-privileged attackers to bypass WDAC through an untrusted assembly search path (CVSS 8.8); Microsoft notes no available workaround and classifies exploitation as more likely. CVE-2026-92707 is a Denial‑of‑Service flaw in MessagePack-CSharp involving improper memory allocation in .NET.
Among 70 critical flaws this month, 57 are remote code execution, with CVE-2026-70242, a Reading Pane RCE in Outlook (CVSS 9.8), highlighted as particularly noteworthy: a crafted email can trigger a heap overflow in the Reading Pane without user interaction or authentication.