Microsoft Breaks Patch Tuesday Record Again with 1400+ CVEs
Microsoft's October 2026 Patch Tuesday fixes 1,411 CVEs, including one actively exploited Windows Shell bypass.
Microsoft's October 13, 2026 Patch Tuesday fixed 1,411 CVEs, more than the just over 1,100 updates released in all of 2025, which the company has tied to AI-assisted discovery including its MDASH scanning harness. One flaw, CVE-2026-96951, a Windows Shell security-feature bypass scored CVSS 8.8, is actively exploited and can be triggered by a user opening a crafted file from email, chat, or a website. Two publicly disclosed but not yet exploited issues are CVE-2026-108398, a .NET bypass of Windows Defender Application Control, and CVE-2026-92707, a network denial of service in MessagePack-CSharp. Of 70 critical bugs, 57 are remote code execution, including Outlook Reading Pane flaw CVE-2026-70242 at CVSS 9.8, which can trigger from preview alone.
- October 2026 fixes 1,411 CVEs, exceeding all of 2025.
- Microsoft links the surge partly to its MDASH scanning harness.
- Actively exploited CVE-2026-96951 is a Windows Shell bypass needing user interaction.
- Disclosed zero-days cover a .NET WDAC bypass and MessagePack-CSharp denial of service.
- Critical Outlook Reading Pane RCE CVE-2026-70242 needs no click to trigger.
Vulnerabilities mentionedAll →
- CVE-2026-1083988.8—Untrusted search path in Microsoft .NET Frameworkpublished · Microsoft .NET Framework
- CVE-2026-702429.8—Heap buffer overflow RCE in Microsoft Outlookpublished · Microsoft Office Outlook
Full article541 words · extracted from infosecurity-magazine.com · click to collapse
Microsoft broke records yet again on October 13, releasing more security updates for this month’s Patch Tuesday than in the whole of 2025.
The tech giant fixed 1411 CVEs for October, an all-time high that beat the records it set in July and September this year. By contrast, it released just over 1100 updates in 2025.
The surge in volume can be traced to Microsoft’s use of AI to find and fix vulnerabilities in its products.
Back in July it warned customers to expect a deluge of patches, thanks in part to its use of multi-model agentic scanning harness (MDASH) technology.
The increased workload for security teams is already having an impact. Socura research published this week found that a fifth (22%) of UK CISOs have called in sick or booked holiday time to avoid Patch Tuesday.
Read more on Microsoft's AI warnings: Microsoft: AI Cuts Post-Compromise Attack Time to Minutes.
The October 2026 haul included one actively exploited and two publicly disclosed zero day vulnerabilities.
The former is CVE-2026-96951, a Windows Shell security feature bypass vulnerability which could lead to malware exposure, data compromise, system integrity violations and operational disruption.
It has a CVSS score of 8.8, involves low attack complexity, and requires no authentication or existing privileges to exploit.
“Attackers can distribute specially crafted files through phishing emails, instant messages, or malicious websites, requiring only user interaction to trigger exploitation,” explained Action1 director of vulnerability research, Jack Bicer.
“The vulnerability can serve as an initial entry point in broader attacks by suppressing expected security warnings and allowing potentially malicious content to bypass protective checks.”
Two New Zero Days Identified
Microsoft also applies the “zero day” label to any vulnerabilities that have been publicly disclosed but not yet exploited in the wild.
One such flaw this month is CVE-2026-108398, a .NET framework security feature bypass vulnerability with a CVSS score of 8.8. It allows authenticated, low-privileged attackers to bypass Windows Defender Application Control (WDAC) through an untrusted assembly search path, according to Action1 president, Mike Walters.
“This vulnerability is particularly dangerous as a post-compromise attack technique, enabling attackers with existing local access to circumvent security restrictions without user interaction,” he explained.
“Successful exploitation could compromise system integrity, expose sensitive business information, weaken endpoint defenses and disrupt critical operations.”
With no workaround available and Microsoft labelling this one “exploitation more likely,” sysadmins should patch without delay, Walters advised.
The second publicly disclosed zero day this month is CVE-2026-92707, a denial-of-service flaw in MessagePack-CSharp.
Microsoft explained that an "improperly controlled sequential memory allocation in .NET allows an unauthorized attacker to deny service over a network."
Of the 70 critical vulnerabilities posted this month, most (57) are remote code execution (RCE) flaws. Among the most noteworthy is CVE-2026-70242, a Reading Pane RCE bug in Outlook with a CVSS score of 9.8.
“A crafted email triggers a heap-based buffer overflow when Outlook shows it in the Reading Pane. The recipient doesn't open the message or click anything. No authentication, no user interaction,” warned Automox.
“Preview-pane bugs surface every few years, and they draw attention because email is the front door. Addresses are easy to find in breach dumps and on company websites, so targeting costs an attacker almost nothing.”
Image credit: wutianzeri / Shutterstock.com