Microsoft's October Patch Tuesday fixes 1,411 flaws, one exploited

Microsoft's October 2026 Patch Tuesday is a record: more than 1,400 vulnerabilities fixed — 1,411 by BleepingComputer's tally, 1,417 per the SANS Internet Storm Center. Among them is one actively exploited zero-day, CVE-2026-96951, a Windows Shell security-feature bypass, plus at least one publicly disclosed flaw. Prioritize the exploited bug; the raw count is unusually large but the triage below is what matters.

Primary source is Microsoft's Security Update Guide; the independent tallies come from BleepingComputer and the SANS ISC October 2026 diary.

The exploited zero-day

CVE-2026-96951 — Windows Shell Security Feature Bypass. Microsoft describes it as command injection in Windows Shell, exploitable over a network, that bypasses the Mark of the Web (MotW) protection. MotW bypasses are the classic phishing enabler: they let a downloaded file run without the "this came from the internet" warning. Microsoft marks it as exploited; it has not published a CVSS score or named who reported the abuse.

Publicly disclosed

CVE-2026-108398 — .NET Framework Security Feature Bypass, rated Important, CVSS 8.8 (per SANS ISC). It can let an attacker bypass Windows Defender Application Control (WDAC) and run code in a protected process without user interaction. James Forshaw of Google Project Zero is credited with the discovery. BleepingComputer also flags a third zero-day, CVE-2026-92707, a MessagePack-CSharp denial-of-service rated Moderate; the SANS diary lists one pre-release disclosure (CVE-2026-108398).

By the numbers

Per BleepingComputer's breakdown, the release skews heavily toward elevation of privilege (677) and remote code execution (317), with 70 rated critical — 57 of those RCE. The 1,411 count excludes 348 flaws Microsoft fixed earlier in the month in Edge and other components. Counts like these vary by how each tracker handles republished and preview CVEs, which is why the two tallies differ by six.

Action checklist

1. Patch CVE-2026-96951 first. It is the only one under active exploitation this cycle and it defeats a protection users rely on to catch malicious downloads.
2. Deploy the cumulative update, not cherry-picks. The Windows updates are cumulative; test and roll the monthly rollup rather than hand-picking individual fixes.
3. Prioritize the critical RCEs (57 of the 70 criticals) on internet-facing and lateral-movement-adjacent systems next.
4. Validate your MotW and WDAC posture. Both bypassed protections (CVE-2026-96951, CVE-2026-108398) are controls you may be counting on in your phishing and application-control defenses — confirm the patches landed where those matter.

Context

A four-figure Patch Tuesday is new territory — by comparison, June 2026's release carried three zero-days across a far smaller set. The headline number is noise for triage: the work is the same every month — find the exploited bug, ship the cumulative update, and don't let the volume push the one flaw attackers are already using to the bottom of the queue.