Microsoft patches record 1,413 flaws including actively exploited Windows bug

Microsoft has issued security updates for a record-breaking 1,413 vulnerabilities across its software ecosystem this month. The October 2026 Patch Tuesday release includes fixes for critical flaws in Windows, Office, and server products, with one Windows Shell vulnerability already being exploited by attackers in the wild.

What happened

The sheer volume of patches marks a new baseline for Microsoft’s security maintenance, surpassing previous monthly records. Of the 1,413 fixed issues, 1,102 affect Windows, while others impact Office, Developer Tools, SharePoint Server, and SQL Server. More than 670 of these flaws allow privilege escalation, and over 300 enable remote code execution. Seventy are rated as Critical severity.

Among the most urgent fixes is CVE-2026-96951, a command injection vulnerability in Windows Shell with a CVSS score of 8.8. Microsoft confirmed that threat actors are actively exploiting this flaw to bypass Mark of the Web (MOTW) defenses. This security feature typically warns users when they open files downloaded from the internet. By evading MOTW, attackers can trick users into executing malicious code via email attachments or links without triggering standard warnings. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog, mandating that federal agencies patch it by October 16, 2026.

Another significant fix addresses CVE-2026-108398, an untrusted search path vulnerability in the .NET Framework. This flaw allows authenticated attackers to bypass Windows Defender Application Control (WDAC) and run unauthorized applications. Unlike the Shell vulnerability, this exploit does not require user interaction once the attacker has local access. It serves as a potent post-compromise technique, allowing adversaries to maintain persistence and execute code within protected processes. Microsoft also patched a high-severity buffer overflow in Raw Image Extension (CVE-2026-21413) that could trigger remote code execution simply by viewing a folder containing a crafted image file.

Key details

• Record volume: Microsoft patched 1,413 vulnerabilities, including 1,102 in Windows and 134 in Office.
• Active exploitation: CVE-2026-96951 in Windows Shell is being exploited in the wild to bypass security warnings.
• Privilege escalation: Over 670 flaws allow attackers to escalate privileges, while 300+ enable remote code execution.
• Local bypass: CVE-2026-108398 allows local attackers to bypass WDAC protections without user interaction.
• New prioritization: Microsoft introduced "risk cohorts" to help organizations group and assess related CVEs more efficiently.
• AI influence: Experts note that AI is accelerating both bug discovery and remediation, contributing to the higher volume of reported flaws.

Background

Patch Tuesday is Microsoft’s monthly schedule for releasing security updates. Historically, these releases contained dozens of fixes, but recent years have seen volumes climb into the hundreds. The term "Mark of the Web" (MOTW) refers to a Windows security feature that tags files downloaded from the internet. Applications check this tag to decide whether to run in a restricted mode or warn the user. Bypassing MOTW is a common goal for attackers because it allows them to deliver malware that appears safe to the operating system.

Windows Defender Application Control (WDAC) is a policy-based feature that restricts which applications can run on a device. It is often used in high-security environments to prevent unauthorized software execution. Vulnerabilities that bypass WDAC are particularly dangerous because they undermine a core defense layer. The concept of "risk cohorts" is Microsoft’s latest attempt to help IT teams manage the overwhelming number of CVEs. Instead of treating each vulnerability in isolation, cohorts group flaws that share similar mitigation strategies or attack vectors, allowing for faster triage.

Why it matters

For teams running self-hosted software on Windows servers or using Microsoft development tools, this record-breaking patch cycle demands immediate attention. The active exploitation of the Windows Shell flaw means that delay increases the risk of compromise significantly. Since the attack vector involves social engineering via email or instant messages, even well-hardened servers can be vulnerable if administrators or users interact with malicious files. The requirement for federal agencies to patch by October 16 underscores the urgency recognized by national security bodies.

The volume of patches also highlights a shifting landscape where AI accelerates vulnerability discovery. As Dustin Childs from the Zero Day Initiative noted, "Hundreds of CVEs in a single release used to be the exception; now it's the baseline." This means IT leads cannot rely on patching every single flaw immediately. Instead, they must prioritize based on exploitability and active threats. Ignoring the actively exploited flaws in favor of lower-risk items leaves systems exposed to known attacks. Conversely, spending too much time on low-risk CVEs burns resources without reducing actual threat exposure.

Additionally, the presence of flaws in components like Raw Image Extension shows that attack surfaces extend beyond traditional server roles. A file server or workstation used for media processing could be compromised simply by browsing a directory. For DevOps engineers managing CI/CD pipelines on Windows, the .NET Framework vulnerability poses a risk if build agents are shared or if local access controls are weak. Understanding these specific vectors helps teams apply patches where they matter most rather than attempting a blanket update that may disrupt operations unnecessarily.

What you can do

• Prioritize patching CVE-2026-96951 and CVE-2026-108398 immediately due to active exploitation and public knowledge.
• Review your Windows Server and workstation inventory to ensure all instances are included in the upcoming maintenance window.
• Educate users about the risks of opening unexpected attachments, as the Shell vulnerability relies on user interaction.
• Use Microsoft’s new "risk cohorts" documentation to group remaining patches and streamline your assessment process.
• Verify that WDAC policies are correctly configured and monitor for any signs of bypass attempts on critical systems.
• Check for updates to Raw Image Extension on machines that handle image files to prevent thumbnail-based exploits.