Microsoft Patched Record 1,411 Flaws as One Was Exploited

1,411 holes. One of them already being used against real people. And a deadline that quietly expired on a huge number of PCs while everyone was counting. Microsoft's October Patch Tuesday was the biggest in the company's history — and the number is the least interesting thing about it.

Published October 14, 2026 · By Daniel Rao

File photo: Building 92 on Microsoft's Redmond campus. Photo: Jiaqian AirplaneFan / Wikimedia Commons / CC BY 3.0

On Tuesday, 13 October, Microsoft shipped its October 2026 Patch Tuesday release: fixes for a record 1,411 flaws across Windows, Office, .NET, SharePoint, SQL Server and more. Seventy of them were rated Critical. One was already being exploited in the wild. And in the same release, Microsoft ended updates for Windows 11 version 24H2 Home and Pro and for Windows 10 Enterprise LTSB 2016.

Read that again, slowly, because the three facts belong together. A record haul of fixes. A live attack against the very warning system meant to protect you. And countless PCs quietly sliding out of support on the same day. Any one of those would carry a news cycle on its own. Together, they make this the most consequential Patch Tuesday in years — not because of the count, but because of what the count is hiding.

We checked TechPulse USA's published log and the live feed before writing this: nothing on this Patch Tuesday had been covered here, and every internal link below was verified to return HTTP 200 before publication.

The one flaw attackers are already using

Start here, because everything else can wait and this cannot. CVE-2026-96951 is a security feature bypass in Windows Shell, rated Important with a CVSS score of 8.8. Microsoft confirms it is being exploited in the wild. It is the only flaw in this release with confirmed active exploitation, and it is the one patch that should jump every queue.

There is a small, familiar moment every Windows user knows: you double-click a downloaded file, and Windows pauses, politely suspicious, to ask whether you really meant that. That pause is Mark of the Web at work. Windows stamps files that arrive from the internet with a zone marker — the Mark of the Web, or MotW — and that tag is what triggers SmartScreen checks, Office Protected View, the block on macros in files from the web, Smart App Control on Windows 11 and the Attachment Manager prompt. It is not one warning. It is the tripwire a whole chain of defences hangs from.

CVE-2026-96951 cuts that tripwire. Microsoft describes the flaw as improper neutralisation of special elements in a command — command injection, in plain terms — in Windows Shell, which lets an unauthorised attacker bypass a security feature over a network. In Microsoft's own words: "Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network." A crafted file arrives without its warning tag, and everything downstream treats it as though you made it yourself. No SmartScreen prompt. No read-only Protected View. No macro block. One flaw switches off several controls at once, which is why a bypass like this is worth far more to an attacker than its CVSS score suggests.

What Microsoft has not said matters almost as much. The company has disclosed no details of how the flaw is being exploited, who is exploiting it, how widely, or who reported it. That silence is normal — vendors rarely publish attack playbooks on patch day — but it means defenders are patching against a threat they cannot yet scope. CISA added CVE-2026-96951 to its Known Exploited Vulnerabilities catalogue on 13 October, with catalogue listings giving US federal agencies until 16 October to remediate. Everyone else should treat that date as a useful deadline rather than someone else's problem: once a MotW bypass is public and patched, the window between patch release and mass exploitation is measured in days, not weeks.

Two more zero-days, not yet exploited

Microsoft counts a flaw as a zero-day when it was publicly disclosed or actively exploited before a fix existed. By that definition, October brings three. The other two have been disclosed but, as far as Microsoft has said, not yet exploited — which is a meaningful difference, not a reason to relax.

CVE-2026-108398 is a security feature bypass in .NET Framework, also rated Important with a CVSS score of 8.8. Microsoft describes it as an untrusted search path flaw that lets an authorised attacker bypass a security feature locally. The attack, as Microsoft lays it out, is a three-step move: an authenticated attacker places a specially crafted .NET assembly on an affected system, registers it for loading by a protected process, and the code then runs inside that process, escaping Windows Defender Application Control (WDAC) restrictions. No user interaction is required. Google Project Zero researcher James Forshaw is credited with discovering it.

Note the prerequisite, because it changes the priority: this is not a drive-by flaw. An attacker needs an account on the machine first. But in environments that lean on WDAC or App Control allowlisting as the last line — the machines where only approved applications are supposed to run at all — a bypass like this is exactly the key an intruder with a foothold wants. Patch it where application control matters, and treat it as urgent there.

CVE-2026-92707 is the quieter of the three: a denial-of-service flaw in MessagePack-CSharp, rated Moderate. Microsoft describes it as improperly controlled sequential memory allocation in .NET, letting an unauthorised attacker deny service over a network. Translation: a remote attacker can make .NET applications that use the MessagePack-CSharp serialisation library chew through memory until they fall over. No data theft, no code execution — just an application that stops answering. For a public-facing service, that is outage by remote control, and Microsoft has not said who disclosed it.

Why the headline number keeps changing

If you have seen this release described as 1,411, 1,413 and 1,414 flaws in different places, you are not imagining things, and nobody is lying. The numbers differ because the counters are counting different things — and this is worth understanding, because the gap tells you something about how Patch Tuesday actually works.

BleepingComputer's 1,411 counts only vulnerabilities released on Patch Tuesday itself, 13 October. It deliberately excludes 348 flaws Microsoft fixed earlier in the month through separate releases, including issues in Azure App Service, Exchange Server, Microsoft Bookings, Microsoft Dataverse, Azure API Center and Azure Event Grid. Count those too and you are already past 1,750 fixes for October as a whole.

The slightly higher tallies — 1,413 in the Microsoft Security Update Guide as summarised by The Hacker News, 1,414 in some aggregations — count the full guide, including republished third-party entries. Microsoft republished at least one such item this month: a Cisco Talos finding, CVE-2026-21413, a raw image extension remote code execution flaw. Different tallies, taken at different times, with different rules about republished entries, land a couple of CVEs apart. None of that changes the substance. Whichever way you count it, this is the largest Patch Tuesday Microsoft has ever shipped — comfortably past September's then-record of roughly 973 to 1,000, July's roughly 600, and October 2025's roughly 175.

The category breakdown carries the same lesson about reading numbers carefully. BleepingComputer's tally: 677 elevation of privilege, 317 remote code execution, 254 information disclosure, 73 denial of service, 40 security feature bypass and 28 spoofing. Those six categories sum to 1,389. The remaining 22 sit in smaller classes, including tampering flaws listed in Microsoft's own table. Seventy flaws in total are rated Critical — 57 remote code execution, 11 elevation of privilege and 2 spoofing.

What 1,411 fixes actually looks like

By product, Windows dominates: 1,102 of the flaws are in Windows, followed by 134 in Office, 61 in Developer Tools, 36 in SharePoint Server and 22 in SQL Server, per tallies of the release, with Exchange, Azure, Defender and other products making up the rest. Elevation of privilege leads the categories, and that shape tells its own story. Privilege-escalation flaws are the raw material of the second stage of an attack: the intruder is already in, and now wants to become admin, move laterally, or persist. A month with 677 of them is a month in which the industry found a great many ways to climb the ladder — and, to be fair, closed them.

Part of the volume is Microsoft finding bugs faster. The company is increasingly using AI platforms to find and fix vulnerabilities, and BleepingComputer links the record total to that shift. Dustin Childs, head of threat awareness at the Zero Day Initiative (ZDI), put the new normal bluntly: "Hundreds of CVEs in a single release used to be the exception; now it's the baseline." AI, in his telling, is accelerating bug-hunting on both sides — vendors are finding and fixing more flaws, and researchers are finding them faster too.

Microsoft also used this release to debut "risk cohorts": 15 experimental groupings of related vulnerabilities meant to help organisations prioritise. The largest cohort, Windows filesystems, storage and backup, holds 136 flaws; Office document and mail clients holds 135. Microsoft stresses the cohorts are experimental and do not replace its existing patching recommendations — and that caution is warranted. A grouping can tell you where to look. It cannot tell you what is being exploited, which is the only signal that should ever sit at the top of a patch queue.

The quieter cliff: PCs just lost updates for good

Buried in the same announcement was a deadline with longer consequences than any single CVE. Microsoft confirmed that Windows 11 version 24H2 Home and Pro — along with Pro Education, Pro for Workstations and SE editions — and Windows 10 Enterprise LTSB 2016 reached end of updates on 13 October. The October security update is the last they will ever receive. No more monthly security fixes, no more known-issue fixes, no more time-zone updates, no more technical support for those editions.

The machines will not stop working. That is precisely what makes the cliff dangerous: everything looks fine while the safety net is gone. Every flaw discovered after 13 October in those editions stays open, permanently, and attackers notice that sort of thing. Enterprise and Education editions of 24H2 get another year, until 12 October 2027. Everyone else on 24H2 is out of time — and Windows 11 23H2 Enterprise, Education and IoT Enterprise editions lose updates next, due on 10 November 2026.

File screenshot: an earlier Microsoft end-of-support notice for Windows 10, shown ahead of the original October 2025 deadline. The message facing 24H2 holdouts today is the same one: update, or lose support. Screenshot: Microsoft / Wikimedia Commons / Public domain

If you are unsure which version you run, check now: Settings, then System, then About — or type winver into the Run dialog. If it says 24H2 on a Home or Pro machine, you need a newer version, not just this month's patch. Windows 11 26H2, which began rolling out on 29 September, is the destination Microsoft is pointing people toward, with Home and Pro support running to October 2028. Because 24H2, 25H2 and 26H2 share one codebase, Windows Latest reports the 26H2 enablement package is only about 174KB on x64 PCs — a switch-flip and a restart, not a reinstall.

What to do first, in this order

First, patch CVE-2026-96951 everywhere, starting with the machines most exposed to untrusted files: anything that receives email attachments, downloads, or shared links. This is the exploited one. Do not wait for the normal maintenance window; treat it as an emergency change, and reboot.

Second, if you run WDAC or App Control allowlisting, prioritise CVE-2026-108398 in the same pass — it is aimed squarely at the control you are relying on. Third, patch the .NET applications that use MessagePack-CSharp against CVE-2026-92707, especially public-facing services where a remote denial-of-service is an outage waiting for a trigger.

Fourth, work the rest of the release by risk cohort and exposure, not by raw CVE count: remote-access and RDP deployments, DNS and DHCP infrastructure, authentication and directory services, and Office and mail clients first. Fifth — and this is the one that gets forgotten in the patching rush — upgrade every machine on an edition that just lost support. Patching a 24H2 Home PC this week is a last rite, not a fix; next month's flaws will have no patch at all. And sixth, the unglamorous part: test before you roll out widely, back up before you roll out at all, and do not let a staging queue become an excuse to leave the exploited flaw open.

Our take: the count is not the story

Here is our position, stated plainly. The 1,411 number is a distraction if you let it be one. Most of these flaws were not introduced last month; they were found last month, by tooling that gets better every quarter. That is genuinely good news — a bug found is a bug that can be fixed — and Microsoft deserves credit for fixing at this pace rather than sitting on a backlog. But it is also the shape of a new normal that nobody has quite admitted to yet: discovery is now scaling faster than exploitation, and the organisations still running a leisurely monthly triage cycle are the ones falling behind.

Treating a 1,411-flaw month as routine would be colossally complacent. The exploited zero-day is the proof: the attackers are not waiting for anyone's change-control board. As Dustin Childs of the Zero Day Initiative advised: "Patch what's proven, prioritized, and public, and treat everything else as this month's new normal." Patch the exploited flaw today, the disclosed bypasses this week, the cohorts in exposure order — and get off the dead editions, because no patch queue in the world will save a machine Microsoft has stopped patching. The record will be broken again, probably soon. Whether that matters depends entirely on what you do before it is.

Sources: BleepingComputer (Patch Tuesday tally, zero-day details, end-of-support announcement); Microsoft Security Update Guide / MSRC advisories (CVE descriptions, CVSS scores, risk-cohort mapping); The Hacker News (1,413 total, product breakdown, Childs comment); Dark Reading (product breakdown, MotW analysis); Computer Weekly (AI-assisted discovery, historical totals); Windows Forum (23H2 deadline, patching order); Windows Report (breakdown, zero-day mechanisms); Windows Latest (26H2 enablement package); Notebookcheck (24H2 support dates); CISA Known Exploited Vulnerabilities catalogue (CVE-2026-96951 listing).

Related on TechPulse USA: Microsoft's rough stretch continues — Microsoft killed Outlook's Copilot themes; the same week, OpenAI's AI caught an engineer bugging its own boardroom; and Brussels tried to ditch Microsoft Teams.

Daniel Rao is a technology reporter for TechPulse USA, covering artificial intelligence, cybersecurity and the business of Silicon Valley.

 

Patch Tuesday: your questions answered

What are the KB numbers for this Patch Tuesday? For Windows 11, the October cumulative updates are KB5127648 and KB5126653; for Windows 10 under extended security updates, KB5126657 — per BleepingComputer’s tally. If your update history shows one of those, you have this month’s fixes. If it doesn’t, you don’t.

When is the CISA deadline? CISA added CVE-2026-96951 to its Known Exploited Vulnerabilities catalogue on October 13, giving US federal civilian agencies until October 16 to remediate. Everyone else should treat October 16 as a useful deadline rather than someone else’s problem: once a Mark-of-the-Web bypass is public and patched, the window between patch release and mass exploitation is measured in days, not weeks.

What is Hotpatching, and why is it in this story? The same week, Microsoft made Hotpatching generally available for Windows Server 2025 Azure Edition VMs — applying patches without a reboot. It is the company’s answer to the obvious question this 1,411-flaw month raises: a monthly patch cycle cannot keep up with this volume, and the infrastructure for continuous patching is arriving whether IT teams are ready or not.

Does the exploited flaw work without a click? No — and that is the one piece of good news. CVE-2026-96951 strips the warning tag from a crafted file, but a user still has to open it. The flaw works best alongside phishing, which is why the patch and a word to your least technical colleague belong in the same afternoon. In the same week, Microsoft killed a Copilot feature in Outlook without explanation — and OpenAI caught its own engineer bugging its boardroom, the strangest insider case of the year.