October Patch Tuesday: Microsoft fixes over 1,400 vulnerabilities, one already exploited

Microsoft released its monthly security patches, known as "Patch Tuesday," on October 13, 2026. The volume sets a record: 1,411 vulnerabilities according to BleepingComputer, 1,407 according to Tenable, with the gap coming from the counting method. Tenable notes that this is the second consecutive record-setting month. Among these flaws, one is already being exploited by attackers and two others had been made public before the patch was released.

A Windows flaw already exploited

The exploited vulnerability, CVE-2026-96951, affects the Windows shell. It is rated 8.8 out of 10 and classified as "important" by Microsoft. It allows attackers to bypass the Mark of the Web (MotW) protection, the marker that tells Windows a file comes from the Internet and triggers security warnings. According to Tenable, the attacker must convince the victim to open a booby-trapped file, received for example by email or through a messaging app. Microsoft has given no details about the ongoing attacks. Tenable points out that this is the third Windows shell flaw exploited in 2026.

Two other flaws were public before a patch was available. The first, CVE-2026-108398, is in .NET Framework: it could allow a local, already authenticated attacker to bypass Windows Defender Application Control (WDAC). According to BleepingComputer, it was discovered by James Forshaw of Google Project Zero. The second, CVE-2026-92707, is a moderate-severity denial of service in the MessagePack-CSharp library.

Exchange and Active Directory to watch

Tenable flags several flaws that Microsoft considers "more likely to be exploited." Three affect Exchange Server, including CVE-2026-70571, a critical remote code execution flaw (8.1) that could be triggered by a malicious email processed by the server, and CVE-2026-70279, a spoofing flaw rated 9.3. Another, CVE-2026-70229, also critical (8.1), affects Active Directory Domain Services: a forged packet could allow code execution. Depending on the count, 69 or 70 flaws are critical, and nearly half of the flaws fixed are elevation of privilege vulnerabilities.

BleepingComputer notes that this total does not include 348 flaws fixed earlier in the month, notably in Azure services, Exchange Server and Dataverse. Microsoft also tested a ranking of flaws into "risk cohorts" (file systems, Office documents, kernel, etc.), warning that this experimental presentation does not replace the usual guidance for prioritizing patches.

What to do

• Deploy the Windows cumulative updates first: KB5127648 and KB5126653 for Windows 11, and KB5126657 for Windows 10 devices enrolled in Extended Security Updates (ESU).
• Patch Exchange servers and domain controllers quickly.
• Remind users to be wary of attachments and downloaded files, even when Windows displays no warning: that is precisely what CVE-2026-96951 bypasses.
• Take stock of your device fleet: according to Microsoft and Tenable, Windows 11 24H2 Home and Pro, Windows 10 Enterprise LTSB 2016, and the extended updates for Windows Server 2012 and 2012 R2 reached end of support this month.