Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day

What it is

October 2026 Patch Tuesday fixes 1,413 CVEs, and one of them is exploited in the wild: CVE-2026-96951 (CVSS 8.8), a Windows shell security feature bypass that defeats Mark of the Web (MotW). Microsoft has patched more than 4,000 flaws so far in 2026.

How it works

MotW tags files downloaded from the internet. Defender SmartScreen and Office Protected View read that tag to restrict automatic execution. With the bypass, a crafted file launches without those warnings. Microsoft's advisory describes delivery by email or instant message, and the attacker cannot force a user to view the content. The user has to take an action, such as opening the file.

The page gives no detail on the attacks themselves. It only notes that threat actors often use MotW bypasses in their campaigns. The flaw was independently reported by Fujitsu, Anthropic, and an independent researcher.

Preconditions / Affected

• Windows endpoints where users open files received by email or chat.
• Reaching the bug takes user interaction, but the bypass removes the warning that would normally stop the user.
• The page gives no affected Windows builds or KB numbers. Check the Microsoft advisory for those.

What to do

• Patch Windows for CVE-2026-96951 first. It is exploited and in CISA KEV, with a federal deadline of October 16.
• Review the other publicly disclosed flaws:
• CVE-2026-108398, a WDAC enforcement bypass. Microsoft rates it unlikely to be exploited. It matters most if you rely on WDAC for application control.
• CVE-2026-92707, a DoS in MessagePack-CSharp, which affects Visual Studio and .NET. Microsoft has not assessed its exploitability. Check any build tooling or apps that use it.
• Try Microsoft's new "risk cohorts" for triage. A cohort groups CVEs that raise the same question about your environment, even if they share no root cause or CVSS score. Microsoft says to still weigh active exploitation, severity, attack vector, user interaction, and product guidance for each CVE.

Caveats

• Microsoft calls risk cohorts "a starting point, not a final decision."
• Product counts: 1,102 Windows, 134 Office, 61 developer tools, 36 SharePoint Server. Exchange, Azure, and Defender also got fixes. The page does not break out severities for these.
• The attribution of the volume surge to AI is the article's claim. The page offers no breakdown to support it.