In a significant move during October 2026, Microsoft released a sweeping set of security patches addressing a historic number of vulnerabilities, among which is a critical Windows zero-day vulnerability currently being exploited.
Massive Patch Release in October
The latest Patch Tuesday from Microsoft saw the resolution of 1,413 Common Vulnerabilities and Exposures (CVEs). These included 1,102 issues within Windows, 134 in Microsoft Office, 61 in developer tools, and 36 related to SharePoint Server. Additionally, other Microsoft products such as Exchange Server, Azure, and Defender received crucial security updates.
This month’s updates represent a higher volume of fixes than all those released throughout 2025, largely influenced by advancements in artificial intelligence. Consequently, the total number of vulnerabilities addressed in 2026 has now exceeded 4,000.
Details on the Exploited Zero-Day
The zero-day vulnerability, identified as CVE-2026-96951 and carrying a Common Vulnerability Scoring System (CVSS) score of 8.8 out of 10, is particularly alarming. Microsoft describes it as a bypass flaw in the Windows shell security feature, which allows attackers to circumvent the Mark of the Web (MotW) protections.
MotW is designed to label files downloaded from the internet, thereby activating security features like Defender SmartScreen and Office Protected View to prevent automatic execution. Exploiting this flaw enables potentially harmful files to run without triggering the usual security warnings.
Microsoft’s advisory notes that attackers could exploit this vulnerability through carefully crafted files delivered via email or instant messaging, although they would need to persuade users to open these files.
Additional Vulnerabilities and New Security Measures
This issue was reported by researchers from Fujitsu, Anthropic, and an independent expert. The Cybersecurity and Infrastructure Security Agency (CISA) has already added CVE-2026-96951 to its Known Exploited Vulnerabilities (KEV) catalog, directing federal agencies to address it by mid-October.
Moreover, two other vulnerabilities were publicly disclosed before Microsoft’s patches. CVE-2026-108398 allows bypassing Windows Defender Application Control (WDAC), although its exploitation is deemed unlikely. The second, CVE-2026-92707, affects the MessagePack-CSharp component in Visual Studio and .NET, introducing a Denial-of-Service (DoS) threat.
Microsoft also introduced the concept of ‘risk cohorts,’ which groups CVEs requiring similar customer assessments. These cohorts aim to help users prioritize updates based on their specific environments and threat levels.
As cybersecurity threats continue to evolve, staying informed and promptly applying security patches remains crucial for individuals and organizations alike.
