Microsoft's October 2026 Patch Tuesday closed a record 1,413 CVEs. The one already used in attacks is CVE-2026-96951, a Windows Shell security-feature bypass scored 8.8.

What happened

The flaw is a command-injection bug in Windows Shell. An unauthorized attacker can bypass Mark of the Web over the network if a user opens a crafted file.

Mark of the Web is the tag Windows puts on files downloaded from the internet. SmartScreen and Office Protected View rely on it. A bypass lets a malicious file open without those warnings.

Microsoft says the attacker still has to convince someone to open the file. It has not named the campaign. Researchers at Fujitsu and Anthropic, plus an independent researcher, reported the issue. CISA added it to the Known Exploited Vulnerabilities catalog on 13 October and set a federal deadline of 16 October.

Two other zero-days were public before the fix: CVE-2026-108398, a .NET Framework path that can bypass Windows Defender Application Control, and CVE-2026-92707, a denial-of-service bug in MessagePack-CSharp. Neither is confirmed exploited.

This month alone exceeds every Microsoft CVE patched in 2025. Microsoft credits AI-assisted bug hunting for much of the volume. BleepingComputer counted 1,411 flaws on the Tuesday drop itself, plus hundreds fixed earlier in the month. Either way, the queue is too large to treat as one flat list.

Who is affected

• Windows 10 and Windows 11 clients, and supported Windows Server builds that receive the October cumulative update.
• Anyone who opens email attachments or downloads that would normally carry a Mark of the Web warning.
• Shops still on Windows 11 24H2 Home and Pro, or Windows 10 Enterprise LTSB 2016: this October update is the last one for those editions.

What to do now

Install the October cumulative update on every supported Windows host before 16 October, and put CVE-2026-96951 ahead of the other 1,400 fixes.

Do not try to patch all 1,413 in one sitting. Microsoft's new risk-cohort view is a sorting aid, not a replacement for the exploited-vulnerability list. After the MotW bypass, review the critical remote-code-execution set, then the Office and SharePoint notes.

If a workstation cannot take the update this week, tighten attachment handling: block risky file types at the mail gateway and keep SmartScreen and Protected View on. That reduces the user-open step. It does not replace the patch.

Source: SecurityWeek, 14 October 2026, Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day. CISA catalog entry: CISA Adds Two Known Exploited Vulnerabilities.

Also on the blog

• Ivanti Connect Secure CVE-2026-104935 zero-day, CVSS 8.6
• CVE-2026-74580: Linux vhost flaw gives local users root
• SAP October 2026: four critical flaws, one scored CVSS 10

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.