On 13 October 2026, Microsoft published a Patch Tuesday release addressing 1,413 CVEs — comfortably the largest it has ever issued. For scale, September 2026 had already set a record at 974 CVEs, and that figure was considered remarkable at the time.
Inside the release are 80 critical flaws and two zero-days, of which one is under active exploitation.
That last detail is worth getting right, because it is widely misreported: there are two zero-days, not two actively exploited bugs. The exploited one is a Windows Shell flaw that disables several Windows security prompts at once. The other needs local access and Microsoft rates exploitation as less likely.
The consensus among the researchers commenting on this release is unusually blunt: ignore the headline number. It is not a measure of risk.
What happened
Where the 1,413 sit
Windows accounts for the overwhelming majority of the release:
Product area | CVEs |
|---|---|
Windows | 1,102 |
Office | 134 |
Developer Tools (Dev Div) | 61 |
SharePoint Server | 36 |
SQL Server | 22 |
Azure | 15 |
Exchange Server | 7 |
Defender | 4 |
Other categories | 32 |
Microsoft also republished a Cisco Talos-reported issue, CVE-2026-21413, a raw image extension remote code execution flaw.
The exploited zero-day: CVE-2026-96951
CVE-2026-96951 (CVSS 8.8) sits in Windows Shell and is the one being exploited in the wild. It was discovered by Anthropic's Claude AI.
The flaw targets Mark of the Web (MOTW) — the tag Windows attaches to files downloaded from the internet, which tells the rest of the operating system that a file came from an untrusted source.
An attacker can craft a file that arrives without that tag. Because so many Windows protections key off MOTW rather than inspecting the file itself, bypassing the tag switches several defences off simultaneously:
SmartScreen reputation checks
Office Protected View
The Office block on macros
Smart App Control on Windows 11
The Attachment Manager warning prompt
Automox researchers compared MOTW to a sticker on a parcel that every guard in the building checks instead of examining the parcel — remove the sticker and the package walks through. The practical result is a downloaded file that behaves as though the user created it locally: no warning dialog, no read-only view, no macro block.
This is why a single CVSS 8.8 matters more than hundreds of higher-scoring entries elsewhere in the release. It is not a vulnerability in one product; it is a vulnerability in an assumption that several products share.
The second zero-day: CVE-2026-108398
CVE-2026-108398 (CVSS 8.8) affects .NET Framework Security and is publicly disclosed but not known to be exploited. Microsoft assesses exploitation as less likely, because it requires local access and a low-privilege account.
It is an untrusted search path issue. Per Automox's analysis, an attacker places a crafted .NET assembly on the endpoint, registers it to load inside a protected process, and executes code there without triggering Windows Defender Application Control (WDAC).
Action1's Mike Walters flagged it as valuable specifically as a post-compromise technique — useful to an attacker who is already inside and wants to weaken endpoint defences. There is no official workaround, so patching is the only mitigation. WDAC-protected environments should treat it as a priority.
The other four worth prioritising
Several non-zero-day issues in this release are more dangerous than either zero-day:
CVE-2026-70242 (CVSS 9.8) — Outlook Reading Pane RCE. A crafted email triggers a heap-based buffer overflow when Outlook renders it in the Reading Pane. No opening the message, no authentication, no user interaction. Preview-pane bugs are rare but severe, and email addresses are trivially obtainable from breach dumps and company websites, so targeting costs an attacker almost nothing.
CVE-2026-105016 (CVSS 9.8) — Microsoft QUIC RCE. A heap-based buffer overflow reachable over the network by an unauthenticated attacker with no user interaction, via a specially crafted packet. It affects Windows 11, Windows Server, .NET and Visual Studio.
CVE-2026-102866 (CVSS 8.1) — SharePoint elevation of privilege. Dustin Childs of the Zero Day Initiative highlighted this as an improper cryptographic signature verification flaw: an attacker holding a valid proof token for a target user can modify it, submit it, and authenticate as that user. The constraint is obtaining a token first — which Childs notes can be achieved several ways.
CVE-2026-65674 (CVSS 8.8) — SQL Server RCE. Deserialization of untrusted data, carrying what ZDI called the best exploitability rating of any SQL Server bug this month. An authenticated attacker sends a crafted request and runs code on the server, with no user interaction required. Childs singled out internet-facing SQL Servers as needing immediate attention.
Exchange and Windows 11 housekeeping
Exchange Server: four security updates (KB5129955, 56, 57 and 58) each address a single high-severity CVE rated CVSS 8.8, covering Exchange 2016, 2019 and Subscription Edition. Given Exchange's history as a target, these should be treated as near-critical. There is also an October 2 out-of-band Exchange update for CVE-2026-96940 that should be applied to all on-premises and hybrid servers.
Windows 11: cumulative updates KB5127648 and KB5126653 bring 23H2, 24H2, 25H2 and 26H2 onto aligned build trains with essentially identical security content. One operational trap worth noting: Windows 11 24H2 Home and Pro are receiving their final security update, so migration planning needs to start now — including testing VPN, VDI, storage and Secure Boot paths.
A reporting note for anyone tracking compliance: verify build numbers, not merely whether a KB is present.
Why the number is misleading
This is the part worth internalising.
Tyler Reguly of Fortra made the sharpest point in the coverage: raw CVE counts have stopped meaning anything. The number that does mean something is how many Microsoft CVEs have landed in CISA's Known Exploited Vulnerabilities catalogue. For 2026 so far that figure is 26. In 2025 it was 30, and the year before 32.
In other words: fewer than 1% of the vulnerabilities Microsoft patched this year are known to be exploited — and that proportion has been falling even as the totals explode.
Why the totals are exploding
This is not a Microsoft-specific phenomenon. According to analysis from Echo cited by Dark Reading, monthly CVE disclosures across the industry grew 145% in two years, from 3,173 in June 2024 to 7,765 in June 2026. Annual disclosures rose from 30,949 in 2023 to 49,979 in 2025, with 2026 on track to exceed that.
Two causes: the general expansion of CVE numbering programmes, and AI-assisted vulnerability discovery. ZDI's Dustin Childs offered the most balanced reading of the AI factor — it is accelerating bug-hunting on both the defensive and offensive sides, but it is not conjuring new bugs into existence. It is compressing the gap between a vulnerability existing and somebody noticing it.
There is a neat illustration of this inside the release itself: the one actively exploited zero-day was found by an AI system.
The strategic consequence: discovery is scaling faster than exploitation. Teams that triage by CVE count rather than exploitability will spend their time on the wrong bugs — and will burn out doing it.
Who is affected
Every Windows estate, given 1,102 of the CVEs are Windows flaws and the exploited zero-day affects Windows Shell.
Anyone running Outlook with the Reading Pane enabled, which is almost everyone.
Organisations with internet-facing SQL Server or SharePoint, both of which have directly exploitable issues this month.
On-premises and hybrid Exchange operators, who have both the October 2 out-of-band fix and four further updates to apply.
WDAC-protected environments, specifically targeted by the second zero-day.
Security and IT operations teams, who face a structural workload problem that will not be solved by working harder through a list of 1,413 items.
What organisations should do
Immediately
Patch the exploited zero-day first. CVE-2026-96951 is being used in the wild and silently disables several layered defences at once.
Prioritise the two unauthenticated remote code execution flaws — CVE-2026-70242 in Outlook and CVE-2026-105016 in Microsoft QUIC. Both are CVSS 9.8 and require no user interaction.
Apply the Exchange updates out of cycle, including the October 2 fix for CVE-2026-96940, rather than waiting for a routine maintenance window.
Check internet-facing SQL Server for CVE-2026-65674 specifically.
Patch .NET Framework runtimes and reboot, particularly in WDAC-protected environments.
Change how you triage
Stop triaging by CVE count or CVSS alone. Patch what is proven exploited, what is publicly disclosed, and what is internet-facing. Treat the rest as background volume.
Wire CISA KEV into your prioritisation as a primary input. It is a far better filter than severity ratings when fewer than 1% of patched flaws are ever exploited.
Weight by exposure, not just by score. An authenticated SQL Server bug on an internet-facing instance outranks a critical flaw on an isolated internal system.
Expect these volumes to continue. Build a process that works at 1,400 CVEs a month, because this is now normal rather than exceptional.
Operational hygiene
Track build numbers, not KB presence, in patch compliance reporting.
Start Windows 11 24H2 Home/Pro migration planning, and test VPN, VDI, storage and Secure Boot paths before you are forced into it.
Do not rely on MOTW-dependent controls as your only layer. This month demonstrates that SmartScreen, Protected View, macro blocking and Smart App Control can all fail together when the tag they depend on is bypassed. Application allowlisting, email attachment policy and endpoint detection all operate independently of it.
Final thoughts
A 1,413-CVE Patch Tuesday looks like a crisis and is mostly an accounting artefact. The genuinely alarming item in this release is a single CVSS 8.8 bug in Windows Shell that strips the Mark of the Web tag from a file — and in doing so turns off SmartScreen, Protected View, the macro block, Smart App Control and the attachment warning in one move. That one flaw matters more than the other 1,412 combined.
The lesson: vulnerability volume and vulnerability risk have decoupled, and most patching programmes are still built around volume. When fewer than 1% of patched flaws are ever exploited, a process that treats the monthly list as a queue to work through is measuring the wrong thing and exhausting the team in the process.
The second lesson is about shared assumptions. MOTW is not a product; it is a signal that five separate defences trust. Bypass the signal and five controls fail at once — which is a reminder that defence in depth only delivers depth when the layers are genuinely independent. Worth auditing where else in your stack several controls rely on one upstream verdict.
Childs' summary of how to cope with the new normal is as good a working rule as any: "Patch what's proven, prioritized, and public" — and accept the rest as this month's background noise.
