Microsoft on October 13 released fixes for more than 1,400 security vulnerabilities across Windows and other products, shattering its own monthly record1,2. The patch set — variously tallied at 1,407 to 1,417 CVEs depending on the tracker — eclipses the previous high of 1,261 set in 2020 and dwarfs September's already elevated count of 9724. The release ran several hours past the usual 1 p.m. Eastern drop time, a delay CSO Online attributed to the sheer length of the list.
Of the total, 76 vulnerabilities carry a critical rating, with seven of those requiring no customer action. The batch includes three zero-day flaws, one of which is confirmed exploited in the wild.
The exploited zero day
CVE-2026-96951, a Windows Shell security feature bypass, is the vulnerability already under active exploitation. It allows an attacker to circumvent Mark of the Web protections, making it easier to execute code delivered via email or instant messaging; the victim must still open the malicious file. Satnam Narang, senior staff research engineer at Tenable, noted this is the third Windows Shell flaw exploited in the wild in 2026, following CVE-2026-21510 — linked to the advanced persistent threat group APT28, also known as Fancy Bear — and CVE-2026-32202, a fix for an incomplete patch of the earlier bug. Twenty-six Windows Shell vulnerabilities have been patched through October 2026, compared with three in all of 2025 and one each in 2024 and 2022.
Other high-priority flaws
A second zero day, CVE-2026-102866, affects SharePoint and allows unauthenticated attackers to exploit cryptographic token validation flaws to hijack targeted user accounts. A third vulnerability, CVE-2026-108398, is a .NET framework security feature bypass that was publicly disclosed before the patch but has not been seen exploited.
The Windows DHCP Server drew ten remote code execution vulnerabilities, five of them critical. Separately, CVE-2026-70571 targets Microsoft Exchange Server via a specially crafted email that triggers remote code execution during content conversion, though Microsoft rates the attack complexity as high.
Adam Barnett, lead software engineer at Rapid7, wrote that vulnerability volumes have risen throughout 2026 and that "there is every reason to suppose that vulnerability volumes will continue to rise"3. Of the 1,413 own-product CVEs Rapid7 counted, 1,102 affect Windows.
ANALYSIS The concentration of 1,102 CVEs in Windows alone, combined with an actively exploited zero day, puts particular pressure on organizations still running on-premises Windows infrastructure.