Microsoft Delivers Record-Breaking Patch Tuesday with 1,413 CVEs Fixed
Microsoft’s October 2026 Patch Tuesday updates resolved a record-breaking 1,413 vulnerabilities across its product portfolio, marking the highest number of flaws addressed in a single month in the company’s history. According to Microsoft’s official advisory, the update includes 1,102 CVEs affecting Windows, 134 in Office, 61 in developer tools, and 36 in SharePoint Server. Additional patches were issued for Exchange Server, Azure, Microsoft Defender, and other enterprise products.
The volume of patches released in October 2026 alone exceeds the total number of vulnerabilities Microsoft patched throughout all of 2025. This surge has pushed the cumulative count of flaws fixed in 2026 beyond 4,000, a trend Microsoft attributes in part to the increasing use of artificial intelligence in vulnerability discovery.
Exploited Windows Zero-Day: CVE-2026-96951 Bypasses Mark of the Web
Among the patched vulnerabilities is a critical zero-day flaw actively exploited in the wild, identified as CVE-2026-96951 with a CVSS score of 8.8 out of 10. Microsoft classifies this vulnerability as a Windows shell security feature bypass that allows attackers to evade Mark of the Web (MotW) defenses.
MotW is a security mechanism that tags files downloaded from the internet, alerting defenses such as Microsoft Defender SmartScreen and Office Protected View to restrict automatic execution of potentially harmful content. By bypassing MotW, attackers can cause malicious files to run without triggering security warnings.
"In an email or instant message attack scenario, the attacker could send the targeted user a specially crafted file that is designed to exploit the vulnerability,"
Microsoft stated in its advisory. "In any case an attacker would have no way to force a user to view attacker-controlled content. Instead, an attacker would have to convince a user to take action."
The vulnerability was independently reported to Microsoft by researchers from Fujitsu, Anthropic, and an independent security expert. While no public details have been released about the specific attacks exploiting CVE-2026-96951, Microsoft noted that threat actors frequently target MotW bypass flaws in malware campaigns.
In response, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-96951 to its Known Exploited Vulnerabilities (KEV) catalog on Patch Tuesday and directed federal agencies to apply the fix by October 16, 2026.
Additional Critical Flaws Patched: WDAC Bypass and DoS in Developer Tools
Two other vulnerabilities in the October update were publicly disclosed before Microsoft released patches. One of these, CVE-2026-108398, allows an attacker to bypass Windows Defender Application Control (WDAC) enforcement. Microsoft assessed this flaw as unlikely to be exploited in the wild.
The second, CVE-2026-92707, is a denial-of-service (DoS) vulnerability affecting the MessagePack-CSharp component used in Visual Studio and .NET frameworks. Microsoft has not yet issued an exploitability assessment for this issue.
Microsoft Introduces ‘Risk Cohorts’ to Streamline Patch Prioritization
Alongside the patch release, Microsoft announced a new framework called ‘risk cohorts’ to help organizations prioritize security updates more effectively. According to the company, a risk cohort is a group of CVEs that require a similar customer assessment, even if they do not share a root cause or CVSS score.
"A risk cohort is a group of CVEs that require a similar customer assessment. The CVEs may not share a root cause or a CVSS score. What they share is a question about the customer environment that can inform prioritization,"
Microsoft explained in a supporting blog post. The company emphasized that risk cohorts are intended as a starting point for decision-making, not a final determination. Customers should still evaluate each CVE based on active exploitation, severity, attack vector, user interaction, and product-specific guidance.
Source: SecurityWeek