Orgs face record 1,413 patches as Microsoft plugs exploited Windows Shell flaw and critical zero-days
Organisations face a massive update cycle as Microsoft patches a record number of vulnerabilities, including a Windows Shell flaw already being exploited in the wild.
Key points
- Microsoft’s October Patch Tuesday addresses 1,413 vulnerabilities, a new record for monthly fixes.
- The release includes an actively exploited zero-day in Windows Shell that bypasses security warnings.
- Two additional publicly disclosed zero-days were fixed, alongside critical Outlook and .NET flaws.
Microsoft has released its October Patch Tuesday updates, fixing a record-breaking 1,413 vulnerabilities across its software portfolio. This massive batch includes a Windows Shell flaw that attackers are already exploiting, alongside two other zero-day vulnerabilities that were publicly disclosed before the patch arrived.
The primary concern for organisations is CVE-2026-96951, a high-severity security feature bypass in Windows Shell with a CVSS score of 8.8. This flaw allows attackers to circumvent the Mark of the Web defence, which normally warns users about potentially unsafe downloaded files. Successful exploitation requires user interaction, such as opening a malicious attachment or clicking a crafted link.
What we know
According to CrowdStrike’s analysis, the October 2026 update released on 13 October addresses 75 critical flaws. The updates cover Windows, Office, .NET, and other Microsoft products. BleepingComputer reported slightly different figures, counting 1,411 vulnerabilities and 70 critical flaws, reflecting variations in how researchers categorise the totals.
Elevation-of-privilege vulnerabilities were the most common category, with 677 instances identified. These could allow attackers to gain additional permissions on affected systems. Remote code execution flaws numbered 317, potentially allowing malicious code to run under certain conditions. Information disclosure vulnerabilities, which could expose sensitive data, accounted for 254 of the fixes.
Another significant issue is CVE-2026-108398, a high-severity flaw in the .NET Framework. This vulnerability allows an authorised attacker to bypass Windows Defender Application Control locally, potentially enabling the execution of unauthorised applications. This flaw was publicly disclosed before the patch was available.
A third zero-day, CVE-2026-92707, has a moderate CVSS score of 5.3. It allows unauthenticated remote attackers to exhaust memory in applications processing specially crafted MessagePack data. The risk depends on how services use the MessagePack-CSharp library to pack and unpack information. Microsoft stated that its growing use of AI to find and fix vulnerabilities means users should expect more fixes in monthly updates.
Defender's checklist
- Verify that Windows Update settings are configured to download and install updates automatically.
- Check for pending restarts after updates are installed to ensure all patches are applied.
- Review application logs for signs of unauthorised privilege escalation or unusual memory usage.
- Ensure that endpoint detection tools are updated to recognise the latest threat indicators.
The background in plain language
Patch Tuesday is Microsoft’s monthly schedule for releasing security updates. A zero-day vulnerability is a flaw that attackers can exploit before the vendor has issued a fix. The Mark of the Web is a digital label Windows adds to files downloaded from the internet, triggering security warnings. Bypassing this label allows malicious files to run without alerting the user or triggering protective software like SmartScreen.
Background: Privilege escalation vulnerabilities
Detect privilege escalation by correlating authentication logs with file permission changes and process creation events. Look for unusual parent-child process relationships, unexpected service account usage and deviations from baseline behaviour. Use endpoint detection platforms to catch runtime anomalies that static scans miss.
Read the full guide: Detect Privilege Escalation: Signals, Tools and Blind Spots
What to do and how to stay safe: Microsoft
- Apply the latest Windows updates immediately to patch the exploited Shell vulnerability.
- Monitor email and instant messaging channels for suspicious attachments or links that prompt immediate action.
- Verify that Windows Defender Application Control policies are correctly configured on critical systems.
- Review network logs for unusual memory consumption patterns that could indicate exploitation of the MessagePack flaw.
Step-by-step guide: Virtual Patching: Benefits, Limits and When to Use It
General security guidance from the TechWire Beat newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Why is the number of vulnerabilities so high this month?
Microsoft attributes the record number of 1,413 fixes to its increased use of AI to identify and resolve security issues.
What is the most dangerous flaw in this update?
The most urgent issue is CVE-2026-96951, an actively exploited Windows Shell bypass with a CVSS score of 8.8.
Do I need to restart my computer after updating?
Yes, Windows may require a restart to complete the installation of security updates and ensure full protection.
