Microsoft’s October 2026 Patch Tuesday landed on Tuesday, October 13, and it is a monster: according to Microsoft, as reported by SecurityWeek and Dark Reading, the release resolves a record 1,413 CVEs, which means Microsoft patched more vulnerabilities this month alone than it did in all of 2025 and pushed its 2026 running total past 4,000. Buried in that mountain is one flaw that demands immediate attention: CVE-2026-96951, an actively exploited Windows Shell security feature bypass that lets attackers sidestep Mark of the Web (MotW) protections, and which CISA has already added to its Known Exploited Vulnerabilities catalog. With a critical QUIC bug and major end-of-support deadlines in the mix, triage really matters. Here’s what IT pros and techs need to know and how to prioritize.
A Record-Breaking Patch Tuesday by the Numbers
The scale of this release is hard to overstate. Dark Reading’s breakdown of Microsoft’s 1,413 CVEs shows Windows carrying the overwhelming majority of the load, with Office, developer tools, and server products following behind:
- Windows: 1,102 CVEs
- Office: 134 CVEs
- Developer tools (Dev Div): 61 CVEs
- SharePoint Server: 36 CVEs
- SQL Server: 22 CVEs
- Azure: 15 CVEs
- Exchange Server: 7 CVEs
- Defender: 4 CVEs
- Other products: 32 CVEs
Tenable ran its own independent tally and arrived at 1,407 CVEs, rating 69 as Critical, 1,337 as Important, and 1 as Low. BleepingComputer, which counts only CVEs released on Patch Tuesday itself, tallied 1,411. Microsoft’s own Security Update Guide release notes for October have since been revised and, as of October 21, list 1,453 CVEs. Whichever count you use, the takeaway is the same: no team can treat every item on this list as equally urgent, and Microsoft itself appears to recognize that (more on its new “risk cohorts” below).
The Exploited Zero-Day: CVE-2026-96951 and Mark of the Web
The headline threat is CVE-2026-96951, a Windows Shell security feature bypass with a CVSS score of 8.8 that is being exploited in the wild. It allows attackers to evade Mark of the Web, the tag Windows applies to files downloaded from the internet. That tag is what triggers downstream defenses such as SmartScreen and Office Protected View, so a successful bypass lets malicious files launch without the warnings users would normally see. As reported by Dark Reading, Automox researchers noted that a MotW bypass can undermine a whole stack of protections:
- SmartScreen: reputation checks on downloaded files and apps
- Office Protected View: the read-only sandbox for documents from the internet
- Office macro blocks: default blocking of macros in internet-sourced files
- Smart App Control: application control on Windows 11
- Attachment Manager prompts: the familiar “are you sure?” security warning
Exploitation still requires a human in the loop. As Microsoft explained, “In an email or instant message attack scenario, the attacker could send the targeted user a specially crafted file that is designed to exploit the vulnerability,” adding, “In any case an attacker would have no way to force a user to view attacker-controlled content. Instead, an attacker would have to convince a user to take action.” In other words, this is a phishing enabler.
The flaw was independently reported by researchers at Fujitsu, Anthropic, and an independent expert. Tenable points out that it is the third Windows Shell flaw exploited in the wild in 2026, following CVE-2026-21510 in February and CVE-2026-32202 in April.
Other Priority Fixes to Put Near the Top of the Queue
Beyond the zero-day, several other vulnerabilities deserve fast-track treatment, including two that were publicly disclosed before patches were available:
- CVE-2026-105016 (Microsoft QUIC, CVSS 9.8): a heap buffer overflow enabling unauthenticated network remote code execution, affecting Windows 11, Windows Server, .NET, and Visual Studio, per Dark Reading
- CVE-2026-108398 (publicly disclosed): a Windows Defender Application Control (WDAC) bypass via the .NET Framework; Microsoft believes exploitation is unlikely
- CVE-2026-92707 (publicly disclosed): a denial-of-service flaw in MessagePack-CSharp in Visual Studio and .NET
- CVE-2026-70229 (Active Directory Domain Services, CVSS 8.1): a critical RCE that Microsoft rates “Exploitation More Likely,” per Tenable
- CVE-2026-70571 (Exchange, CVSS 8.1): a critical Exchange Server remote code execution flaw
- CVE-2026-70279 (Exchange, CVSS 9.3): an Exchange Server spoofing (cross-site scripting) vulnerability that Microsoft rates Important despite its high CVSS score, and assesses as “Exploitation More Likely”
- CVE-2026-69923 (Windows AI, CVSS 7.8): an elevation of privilege bug that Microsoft also rates “Exploitation More Likely,” per Tenable
To help teams cut through the noise, Microsoft introduced risk cohorts this month. As Microsoft put it, “A risk cohort is a group of CVEs that require a similar customer assessment. The CVEs may not share a root cause or a CVSS score. What they share is a question about the customer environment that can inform prioritization.” The company was careful to add that “Risk cohorts are a starting point, not a final decision. Customers should continue to review each CVE for active exploitation, severity, attack vector, user interaction, and product-specific guidance.”
Patch and Support Deadlines You Cannot Miss
The fix for CVE-2026-96951 ships in the October cumulative updates for supported versions of Windows 10, Windows 11, and Windows Server 2012 R2 through Windows Server 2025, according to Threat Frontier. CISA added the flaw to its KEV catalog on Tuesday, and federal agencies must remediate by October 16, a tight window that private-sector teams would be wise to match. There is an important catch: Windows 10 PCs outside Extended Security Updates (ESU) do not receive this fix. KB5126657 covers Windows 10 ESU, Enterprise LTSC 2021, and IoT Enterprise LTSC 2021.
October 13 was also a major lifecycle milestone, as Tenable highlighted:
- Windows Server 2012 / 2012 R2: the final year of ESU ended, so no more security updates will be released
- Windows Server 2022: mainstream support ended; the product enters extended support through October 14, 2031, with security updates continuing, and Windows Server 2025 is the upgrade path
- Office 2021 family: Office 2021, Office LTSC 2021, Office LTSC 2021 for Mac, and Skype for Business LTSC 2021 reached end of support
- Windows 11 Home and Pro 24H2: also reached end of support on the same day
- Windows 10 Enterprise LTSB 2016 / IoT Enterprise LTSB 2016: extended support ended, making October 2026 their final security update
Looking Ahead
A 1,413-CVE month is a signal that vulnerability volume is entering a new era, and Microsoft’s introduction of risk cohorts suggests the company knows that raw counts and CVSS scores alone no longer give defenders a workable plan. For IT teams, the practical playbook is clear: patch the actively exploited MotW bypass first, fast-track the QUIC, AD DS, and Exchange criticals, and use the new cohort guidance to organize the rest rather than replace careful per-CVE review.
The lifecycle deadlines may prove just as consequential over the long run. With Windows Server 2012 and 2012 R2 now permanently out of security updates, unprotected Windows 10 machines missing this month’s zero-day fix, and the Office 2021 family and Windows 11 24H2 Home and Pro aging out, every unsupported system left in production becomes a growing liability. Expect upcoming Patch Tuesdays to keep raising the stakes for organizations that delay their upgrade plans.
Correction (Oct 21, 2026): An earlier version of this article described CVE-2026-70279 as a critical Exchange vulnerability; Microsoft rates it Important (CVSS 9.3). It also attributed the “Exploitation More Likely” ratings for CVE-2026-70229 and CVE-2026-69923 to Tenable; those are Microsoft’s Exploitability Index ratings, as reported by Tenable. The article has also been updated to note Microsoft’s revised CVE count of 1,453 as of October 21, BleepingComputer’s count of 1,411, and the end of support for Windows 10 Enterprise LTSB 2016.
Sources:
- Microsoft Security Update Guide, October 2026 Security Updates release notes (updated October 21, 2026)
- Microsoft Support, KB5126657, October 13, 2026
- CISA Known Exploited Vulnerabilities Catalog and alert, October 13, 2026
- SecurityWeek, October 14, 2026
- Dark Reading, October 13, 2026
- Tenable, October 13, 2026
- BleepingComputer, October 13, 2026
- Krebs on Security, October 13, 2026
- CrowdStrike, October 2026
- Automox, October 2026
- CVE.org record for CVE-2026-96951, October 2026
