Microsoft's Record 1,413-Flaw Patch Tuesday: One Zero-Day Under Attack, Two Publicly Known
Microsoft's October 2026 security release is the largest it has ever shipped: fixes for 1,413 vulnerabilities in a single Patch Tuesday. Almost all of that volume is routine, but one bug, a Windows Shell flaw that lets attackers bypass Mark of the Web, is already being exploited in the wild. Two more were publicly known before patches were available.
What happened
Windows takes the bulk of the fixes (1,102), followed by Office (134), Developer Tools (61), SharePoint Server (36) and SQL Server (22). By impact, privilege escalation leads with more than 670 entries, followed by 300+ remote code execution bugs and about 250 information disclosure issues. Over 70 are rated Critical.
These are the three issues that matter most this month:
| CVE | Component | CVSS | Status |
|---|---|---|---|
| CVE-2026-96951 | Windows Shell (command injection → security feature bypass) | 8.8 | Exploited in the wild, in CISA KEV |
| CVE-2026-108398 | .NET Framework (untrusted search path → WDAC bypass) | 8.8 | Publicly disclosed |
| CVE-2026-92707 | MessagePack-CSharp (uncontrolled memory allocation → DoS) | 5.3 | Publicly disclosed |
CVE-2026-96951: the one being exploited. An attacker who gets a user to open a booby-trapped file, typically sent by email or chat, can bypass Mark of the Web (MOTW). MOTW is the tag Windows adds to files from the internet, and it triggers SmartScreen and Office Protected View. The attack can't run by itself: the victim has to click a link or open an attachment. Microsoft hasn't said who is using the flaw or against whom. CISA has added it to its Known Exploited Vulnerabilities catalog, and US federal agencies must patch by 16 October 2026.
CVE-2026-108398: a post-compromise tool. An attacker who already has authenticated access can plant a crafted .NET assembly and get a protected process to load it. That bypasses Windows Defender Application Control (WDAC) and runs code inside the protected process, with no user interaction. It doesn't get an attacker in, but it lets someone who is already in get past one of the main allow-listing controls on the endpoint.
CVE-2026-92707 is a network denial-of-service bug in the widely used MessagePack-CSharp serialization library. The fix matters for .NET applications that bundle that library, not only for Windows hosts.
The release also patches CVE-2026-21413 (CVSS 9.8), a heap overflow in the Raw Image Extension that isn't tracked as a Microsoft CVE. It can be triggered just by browsing to a folder that contains a malicious RAW image: Windows generates the thumbnail or preview automatically, so the file never has to be opened.
Why it matters
The size of this release is part of a trend. Microsoft fixed nearly 1,000 flaws last month and more than 4,000 so far this year. Researchers generally credit AI-assisted bug hunting for much of the increase: defenders and attackers are both finding flaws faster. So the raw CVE count no longer tells you much. A team that works through 1,413 entries in order will spend its first days on bugs nobody is exploiting.
Microsoft has responded with "risk cohorts", groups of CVEs that need the same kind of assessment. They can help with triage, but Microsoft itself describes them as a starting point. You still need to check exploitation status, attack vector and exposure for your own environment.
What to do
- Patch CVE-2026-96951 first, on every Windows endpoint, prioritizing users who handle a lot of external email and chat. Treat the CISA deadline of 16 October as your own deadline.
- Add mail and chat-gateway defenses while the rollout finishes. Block or sandbox risky attachment types (LNK, ISO/IMG, archives containing executables), and look for files arriving without a Zone.Identifier stream.
- Patch the Raw Image Extension through the Microsoft Store/Intune, not only through Windows Update. Confirm the patched version is installed on devices that open shared folders or downloads.
- Don't rely on WDAC alone until CVE-2026-108398 is fixed. Watch for unexpected .NET assemblies being registered or loaded by protected processes.
- Update .NET applications that bundle MessagePack-CSharp, and rebuild and redeploy them. The OS patch doesn't fix copies bundled inside your applications.
- Prioritize by exploitability, not volume: actively exploited (KEV) → publicly disclosed → internet-facing RCE → everything else in the normal cycle.
Not sure which of your internet-facing assets are exposed to this month's bugs? A 4Tify vulnerability assessment identifies the affected technology on your external attack surface so your team can see where to patch first.
This summary is based on original reporting by The Hacker News.