Microsoft's Biggest Patch Tuesday Yet: 1,411 Flaws and Three Zero-Days
Microsoft shipped its October 2026 Patch Tuesday on October 13, repairing 1,411 vulnerabilities across Windows 11, Windows 10, Windows Server, .NET and developer tooling — the largest single security release in the company's history, and the second record in a row after September's 974. BleepingComputer broke the number, and IT之家 and IT时代网 repeated it in Chinese. The 1,411 figure excludes a separate batch of 348 fixes Microsoft published earlier on October 2, which is why tallies elsewhere disagree: MSRC's own guide lists 1,413 CVEs, Rapid7 counts 1,413, and SANS ISC reports 1,417. One outlet's claim of 1,118 finds no support in primary sources.
Three of the fixes are zero-days. Only one, CVE-2026-96951, is confirmed exploited in the wild: a Windows Shell security feature bypass scoring 8.8 on CVSS. Microsoft's advisory credits Fujitsu researchers Riku Bamba and Yuya Chudo, Anthropic's Benoit Sevens working with Claude, and a researcher using the handle yhw. Microsoft disclosed no details about the attackers, the targets or the scale of the campaign.
Technically it is command injection in Windows Shell, and it defeats Mark of the Web, the tag Windows stamps on files that arrive from the internet. SmartScreen, Office Protected View, the Office macro block, Smart App Control on Windows 11 and the Attachment Manager prompt all read that tag before deciding how to treat a file. Exploiting the bug lets an attacker deliver a file that never receives the tag at all, so every downstream guard treats it as trustworthy. Microsoft notes that exploitation requires user interaction — a phishing message convincing the target to open a crafted attachment or follow a link. CISA added the CVE to its Known Exploited Vulnerabilities catalog the same day and gave federal agencies until October 16 to patch.
CVE-2026-108398 affects the .NET Framework: an authenticated attacker can place a specially crafted .NET assembly on a system and bypass Windows Defender Application Control to run unauthorized software. CVE-2026-92707 hits the MessagePack-CSharp library, where uncontrolled memory allocation lets a remote attacker crash .NET applications with a denial-of-service. Both were publicly disclosed before Patch Tuesday; neither Microsoft nor CISA confirms active exploitation.
By class, the release closes 677 elevation-of-privilege bugs, 317 remote code execution flaws, 254 information disclosures, 73 denial-of-service issues, 40 security feature bypasses and 28 spoofing bugs. Seventy are rated critical — 57 remote code execution, 11 elevation of privilege and 2 spoofing — though SecurityOnline counts 78 critical fixes, another reminder that the totals are contested.
New this month is a "risk cohort" mechanism that groups related vulnerabilities under shared assessment questions so enterprises can decide what to patch first. October shipped 15 cohorts; the largest, Windows filesystems, storage and backup, covers 136 vulnerabilities. The feature is still experimental.
Monthly volumes went from 112 in January to 974 in September and 1,411 in October, a year-on-year increase of 563.37%; the January-to-September total of 3,920 is up 274.05% year on year. Whatever the exact denominator, October is an order of magnitude larger than recent cycles.
October 13 was also a lifecycle deadline. Windows 11 24H2 Home and Pro and Windows 10 Enterprise LTSB 2016 reached end of updates, making this monthly security fix their last; enterprise and education editions of 24H2 continue until October 12, 2027, while 23H2 enterprise and education get one final round on November 10, 2026.
Consumers should run Windows Update and install the cumulative update, and treat unexpected attachments with suspicion until it lands. Administrators should sequence the work: CVE-2026-96951 first, then .NET systems relying on WDAC, then the 70 critical fixes and internet-facing servers, and finally an inventory of managed devices still on 24H2 Home or Pro that need moving to 25H2 or 26H2 before they stop receiving patches for good.