Microsoft Fixes 1,411 Flaws in October Patch Tuesday, One Exploited

Microsoft's October 2026 Patch Tuesday fixed 1,411 vulnerabilities on Oct. 13 by BleepingComputer's count, the largest monthly release on record. One of them is already exploited: CVE-2026-96951, a Windows Shell flaw that strips the Mark of the Web tag from downloaded files (the target must open a crafted file, no other privileges needed).

The headline number is real but soft. Three trackers that published the same week report three different totals, and each one's own category breakdown fails to add up to its own total.

What an attacker gets from CVE-2026-96951

The exploited flaw is a Windows Shell security feature bypass rated 8.8. Windows attaches Mark of the Web to files that arrive from the internet, and SmartScreen, Protected View and Office's macro blocking all key off that tag. SOCRadar's write-up says the bug removes the tag, so none of the three warns the user.

PDQ's summary adds the precondition that matters: exploitation requires a user to open the file. That makes it a phishing-chain component rather than a standalone remote attack. BleepingComputer's table lists it as actively exploited and gives no detail on who is exploiting it or who reported it. The score of 8.8 is fair for what the bug does, but it understates its role. A bypass like this is the step that turns a downloaded attachment from a file with warnings into a file without them.

How many flaws, depending on who counts

The trackers disagree because they scope the month differently. BleepingComputer counts only flaws released on Patch Tuesday itself and excludes 348 fixed earlier in October. SOCRadar reports 1,413. PDQ reports 1,414.

Source	Total reported	Critical	Category rows sum to
BleepingComputer	1,411	70	1,389
SOCRadar	1,413	Over 70	Not given
PDQ	1,414	78	1,410

The prior month was 974 CVEs, according to SOCRadar and PDQ's passing reference to "a 974-CVE month". That puts October about 45 percent above September. BleepingComputer's write-up ties the record to Microsoft's use of AI platforms to find and fix flaws. The write-up does not say how many of the 1,411 came from that work, and none of the three sources breaks the count out by discoverer.

1. Elevation of privilege677 flaws
2. Remote code execution317 flaws
3. Information disclosure254 flaws
4. Denial of service73 flaws
5. Security feature bypass40 flaws
6. Spoofing28 flaws

Source: BleepingComputer, Oct. 13, 2026; categories sum to 1,389 of 1,411

Elevation of privilege makes up 677 of the 1,389 categorised flaws, about 49 percent. Remote code execution is 317, with 57 of the 70 Critical flaws in that category per BleepingComputer.

The two other zero-days and how each one is limited

Microsoft counts a flaw as a zero-day when it was publicly disclosed or exploited before a fix existed, which is how this month reaches three.

CVE-2026-108398 is a .NET Framework bypass of Windows Defender Application Control (WDAC), rated 8.8 and affecting .NET Framework 3.5 through 4.8.1. It needs local access. A low-privilege local attacker can run code in a protected process without WDAC blocking it. James Forshaw of Google Project Zero is credited with finding it, per BleepingComputer. Microsoft rates exploitation as less likely, according to PDQ.

CVE-2026-92707 is a denial of service in the MessagePack-CSharp library, rated 5.3 and reachable by an unauthenticated network attacker. The library is a dependency, so the exposure is in whatever bundles it. SOCRadar suggests dotnet list package --include-transitive to find copies.

Five Outlook flaws rated 9.8

SOCRadar lists five Outlook remote code execution flaws at 9.8, all unauthenticated and network-reachable: CVE-2026-97749, CVE-2026-88156, CVE-2026-70291, CVE-2026-70242 and CVE-2026-97016. For CVE-2026-70291 and CVE-2026-88156 the Preview Pane is an attack vector, so a crafted message can run code when it is rendered, without a click.

None is reported exploited. A 9.8 with no exploitation reported and a Preview Pane path still outranks an 8.8 that is exploited only if your users open attachments. Which one goes first depends on whether you can turn off the Preview Pane faster than you can deploy a cumulative update.

BleepingComputer's table also names CVE-2026-70229, an Active Directory Domain Services remote code execution flaw. PDQ rates it 8.1 and says exploitation depends on specific network conditions and timing, with crafted packets from an unauthenticated attacker. The two highest scores of the month, CVE-2026-96207 in Partner Center (10.0) and CVE-2026-94510 in Bookings (9.9), were fixed server-side, so customers have nothing to install, per SOCRadar.

What to patch first, and what still has no fix

Deploy the October cumulative update to endpoints first for CVE-2026-96951, SOCRadar advises, and keep SmartScreen and Office Protected View enforced until coverage is complete. Domain controllers come next because of CVE-2026-70229. PDQ's advice is blunt: "get your domain controllers tested and patched", with a rollback plan ready.

The count is also a workload figure, and it follows a 974-fix September. Earlier coverage on this site dealt with single exploited flaws, such as the PAN-OS management interface bug and the Cisco Secure Email Gateway attachment flaw. This release has 1,411 rows and one confirmed exploited flaw, so the work is ranking, not reading.

SOCRadar also lists end-of-support systems that do not receive these fixes, among them Windows Server 2012 and 2012 R2 and Office 2021 LTSC. The next Patch Tuesday falls on Nov. 10.