Microsoft's Record October 2026 Patch Tuesday Fixes 1,413 CVEs

Microsoft Patch Tuesday for October 2026 fixed 1,413 vulnerabilities on October 13, the largest release on record, and one of the flaws is already being exploited. For Windows users and IT teams, this is less a single update than a sorting problem, and it comes with a federal deadline just three days after release.

How many flaws Microsoft Patch Tuesday fixed this month

Microsoft's count, as reported by SecurityWeek, is 1,413 CVEs, and 1,102 of them affect Windows. Office accounts for 134, developer tools for 61 and SharePoint Server for 36. Severity leans heavily toward the dangerous end: 78 flaws are rated critical, and 65 of those enable remote code execution. The rest of the critical group includes 11 elevation-of-privilege flaws and two spoofing bugs. Cybernews counted another 1,329 as important.

Totals differ by tracker. The three figures in wide circulation are below.

TechRepublic attributes the gaps to differences in which vulnerabilities and updates each researcher counts. This article uses Microsoft's 1,413 figure, and you should name the tracker whenever you cite a number.

Why the exploited Windows Shell flaw matters most

The flaw that needs attention first is CVE-2026-96951, a Windows Shell security-feature bypass with a CVSS score of 8.8. It lets an attacker evade Mark of the Web (MotW) protections. Windows uses MotW to flag files that came from the internet, and bypassing it allows malicious files to launch without the warnings users would normally see.

Researchers at Fujitsu, Anthropic and an independent expert reported the flaw to Microsoft independently, according to SecurityWeek. CISA added it to its Known Exploited Vulnerabilities catalog on Tuesday and told federal agencies to fix it by October 16.

A secondary report from BigGo Finance says Microsoft's release notes state that exploitation has been detected. That wording comes through a relay, so confirm it against Microsoft's Security Update Guide before citing it. Shattered.io counts this as the third Windows Shell zero-day to see active abuse in 2026, a pattern that suggests the file-trust checks in Windows Shell remain a target. USA 24 has covered the patch deadline for this flaw in detail, so this article focuses on the release as a whole.

Nothing public yet says who is exploiting CVE-2026-96951, how they are doing it, or whether any ransomware group has used it. Threat actors often use MotW bypasses inside their campaigns, because they let a malicious download run without the prompt that would normally stop it. Security teams should treat this as a live threat rather than a lab exercise.

Risk cohorts: a new way to sort 1,413 fixes

Microsoft introduced “risk cohorts” with this release. TechTimes reports that they group the 1,413 CVEs into 15 clusters by affected subsystem. The three largest hold 136 CVEs for Windows filesystems and storage, 135 for Office documents and mail clients, and 131 for Windows graphics and media.

For IT teams, that structure helps. Working through 1,400 individual entries is unrealistic for most patch teams, but splitting the queue by subsystem lets one group take storage while another handles Office and mail. The grouping does not change urgency, though. CVE-2026-96951 belongs at the top of any queue because of its active exploitation and the October 16 federal deadline, whatever cluster it sits in.

Volume is unlikely to drop soon. Malwarebytes reports that Microsoft has said its growing use of AI to find and fix security vulnerabilities means users should expect more fixes in its monthly updates. If that holds, the cohort format may matter more with each release, and record counts may stop looking like outliers.

Outlook bugs, two more zero-days and end of support

TechTimes also summarizes five Outlook preview-pane remote code execution bugs that fire without a user click. Public reporting does not confirm that attackers have exploited them yet. Because no click is required, they belong near the top of the Outlook patch list regardless.

Two other flaws were patched as publicly disclosed zero-days, meaning details were public before fixes arrived. BleepingComputer identifies CVE-2026-108398 as a .NET Framework security-feature bypass. BigGo Finance reports that CVE-2026-92707, a denial-of-service flaw in the MessagePack-CSharp library, was also patched as a publicly disclosed zero-day.

Microsoft also announced that Windows 11 version 24H2 Home and Pro, and Windows 10 Enterprise LTSB 2016, have reached end of support. Those editions no longer receive security updates, so they will not get fixes like these. A recent USA 24 report on Ivanti Connect Secure shows why timing matters: that zero-day was exploited for 12 days before a patch arrived. Once a fix ships, the risk moves to every machine that has not installed it.

What Windows users and IT teams should do now

• Open Settings, choose Windows Update, select Check for updates, install the October 2026 updates, and restart.
• Run winver to confirm your Windows version, then check that the October cumulative update is installed.
• Put CVE-2026-96951 at the front of the queue. Federal agencies must patch it by October 16, and private-sector teams should treat that date as a benchmark.
• Patch Outlook promptly, given the five preview-pane bugs that reportedly need no click.
• Split triage using the 15 risk cohorts, so storage, Office and graphics owners each work their own list.
• If you run Windows 11 version 24H2 Home or Pro, or Windows 10 Enterprise LTSB 2016, schedule an upgrade to a supported release.

FortiBleed remains a separate threat for Fortinet customers

Unrelated to Microsoft but still active: the FBI and Secret Service warned that a monthslong credential-harvesting campaign called FortiBleed has escalated to the point where Fortinet FortiGate customers are being locked out of their devices. Cybersecurity Dive covered the warning. The advisory is dated October 6, which falls outside the 72-hour window of the Microsoft release, but The Hacker News reports the campaign remains active and has amassed 86,644 Fortinet device credentials.

According to The Hacker News, the FBI and Secret Service guidance calls for restricting external management access, terminating active sessions, resetting credentials and enabling phishing-resistant multifactor authentication. No update on the lockouts after October 7 surfaced in the reporting reviewed, so it is unclear whether the scope is still growing. Teams that run FortiGate devices should not wait for that answer before acting.

What to watch next

Watch three things over the next few weeks. First, whether agencies meet the October 16 CISA deadline and whether Microsoft adds exploitation details to its Security Update Guide entry for CVE-2026-96951. Second, whether researchers confirm attacks against the Outlook preview-pane bugs. Third, whether risk cohorts return in future releases while AI-assisted discovery keeps the counts high. The next scheduled Patch Tuesday falls on November 10, 2026, and it will show whether October was an outlier or a new baseline.