Microsoft Record October Patch Tuesday Fixes 1,400+ Flaws Including Zero-Day Under Active Attack

Microsoft has released its October 2026 security updates, addressing a reported 1,411 vulnerabilities in its largest Patch Tuesday release to date, including a Windows security bypass already being exploited and two additional flaws disclosed publicly before Microsoft’s monthly fixes.

The October 13 release includes 70 vulnerabilities rated Critical. Of those, 57 involve remote code execution, 11 involve elevation of privilege, and two involve spoofing.

The most immediate concern is CVE-2026-96951, a Windows Shell vulnerability that attackers have used to bypass Mark of the Web protections. The other two zero-days affect .NET Framework application-control enforcement and the MessagePack-CSharp serialization library.

Together, they present distinct…