Microsoft's October Patch Tuesday Lists 1,413 CVEs by One Count and 1,415 by Another, With One Exploited Windows Shell Bug

An attacker who can get a crafted file in front of a Windows user can bypass Mark of the Web protections through CVE-2026-96951 (CVSS 8.8, Windows Shell, no credentials needed), and Microsoft says it is being exploited. Apply the October 2026 cumulative update; CISA gave federal civilian agencies until Oct. 16 to do so.

CISA added the flaw to its Known Exploited Vulnerabilities catalog on Oct. 13, the same day as the Ivanti Connect Secure authentication bypass, according to its alert. The catalog entry carries a due date of 2026-10-16, three days out, and lists ransomware use as "Unknown".

What CVE-2026-96951 needs and what it gives

The Hacker News describes a command injection that lets an unauthenticated network attacker bypass a security feature, typically through a file sent by email or instant message. Mark of the Web is the flag Windows attaches to files from the internet so that SmartScreen and Office can warn before running them. Removing it does not run code by itself, so the score overstates a direct impact but understates the role as a first step: the bypass is what lets a downloaded payload open without the usual prompt.

The Hacker News lists the reporters as Fujitsu's Riku Bamba and Yuya Chudo, Anthropic's Benoit Sevens and a researcher named yhw. Who is exploiting it, and against whom, is unclear in both the vendor record and the reporting.

The count depends on who is counting

The Hacker News reports a record 1,413 Microsoft CVEs. Dustin Childs, who writes the Zero Day Initiative's monthly review, counts 1,415 and calls the tally "tricky". He also counts 86 rows rated Critical in the release table, where The Hacker News says "over 70". Neither counted the same way, and the Microsoft release note could not be read in full for this report.

1. Windows1102 CVEs
2. Office134 CVEs
3. Developer Tools61 CVEs
4. SharePoint Server36 CVEs
5. SQL Server22 CVEs

Source: The Hacker News, Oct. 14, 2026 (remaining 58 CVEs not broken out)

Childs wrote that the volume "exceeds any previous year" of Microsoft CVEs, by the ZDI summary, and quoted himself: "Hundreds of CVEs in a single release used to be the exception; now it's the baseline." The Hacker News puts September at nearly 1,000.

Which of the 1,413 to patch first

CVE	Product	CVSS	Status
CVE-2026-96951	Windows Shell	8.8	Exploited, KEV due Oct. 16
CVE-2026-108398	.NET Framework (WDAC bypass)	8.8	Publicly known, found by Google Project Zero's James Forshaw
CVE-2026-102866	SharePoint	8.1	Only Critical SharePoint CVE; unauthenticated
CVE-2026-65674	SQL Server	8.8	Deserialization remote code execution, no user interaction

ZDI also flags CVE-2026-70571 in Exchange as technically wormable, though Microsoft says exploitation is not guaranteed, and an Adobe ColdFusion bulletin, APSB26-144, with a CVSS 10 pre-authentication profile. ZDI counts 174 unique Adobe CVEs across 11 bulletins and no exploited Adobe bug.

Microsoft also introduced "risk cohorts", groups of CVEs that need similar assessment, which it calls a starting point rather than a final decision.

What to do before Oct. 16

Install the October cumulative update on Windows clients first, because the exploited flaw arrives by file. Then patch SharePoint and SQL Server hosts reachable by unauthenticated users. Childs' own advice: "Patch what's proven, prioritized, and public."

One caution from the sources: The Hacker News' links for CVE-2026-108398 and CVE-2026-92707 point at each other's Microsoft pages, so confirm both IDs in the Security Update Guide before filing tickets. For a wider view of this autumn's edge-device exploitation, see the SonicWall SMA1000 attempts.

The next fixed date is Oct. 16, when the CISA deadline for CVE-2026-96951 falls due.