Microsoft's October 2026 Patch Tuesday fixes a record 1,413 vulnerabilities, including a Windows zero-day already exploited in the wild, in the largest security release the company has ever shipped. The month alone exceeds Microsoft's vulnerability count for the whole of 2025 and pushes the number of flaws fixed in 2026 past 4,000, driven largely by AI-assisted analysis. Windows accounts for 1,102 of the fixes, with 134 in Office, 61 in developer tools and 36 in SharePoint Server.

The exploited zero-day

The most urgent fix is CVE-2026-96951, a Windows Shell security-feature bypass scored 8.8 that lets attackers evade Mark of the Web, the label Windows attaches to files downloaded from the internet. Bypassing it removes SmartScreen warnings and Office Protected View protections, so a malicious file can launch without the usual warnings. Exploitation requires the user to open a specially crafted file sent by email or instant message, and CISA added the flaw to its Known Exploited Vulnerabilities catalog with a 16 October remediation deadline for federal agencies.

The rest of the release

The release includes 677 elevation-of-privilege flaws, 317 remote code execution flaws and 254 information-disclosure flaws, with counts of Critical flaws varying by analyst methodology, from 70 to 75. Five Critical Outlook remote code execution flaws scored 9.8 include two exploitable through the Reading Pane, and a .NET Framework flaw could let an authenticated attacker bypass Windows Defender Application Control. The sheer volume means security teams must prioritise the exploited zero-day and the Outlook flaws first, rather than working through the list in order.