Microsoft’s October 2026 Patch Tuesday, released October 13, is the largest on record. Counts differ by tracker because of how bundled Edge/Chromium and third-party components are tallied: Tenable reports 1,407 CVEs, BleepingComputer 1,411, and others 1,413. BleepingComputer counts about 70 rated Critical, including roughly 317 remote code execution and 677 elevation-of-privilege flaws. Three are zero-days, and one is confirmed exploited in the wild.

The exploited zero-day: CVE-2026-96951

CVE-2026-96951 is a Windows Shell security feature bypass, CVSS 8.8, rated Important. It lets an unauthenticated attacker evade Mark of the Web (MotW) protections by getting a user to interact with a specially crafted file. It is classified as CWE-77 (improper neutralization of special elements used in a command).

MotW is the zone identifier Windows attaches to files from the internet. It triggers SmartScreen reputation checks, Office Protected View, and the “this file came from another computer” prompts. A bypass strips that friction. Payloads delivered through email attachments, archives, ISO/VHD images or download links then run without the warnings that normally stop commodity malware and many initial-access campaigns.

Microsoft has not said who is exploiting it, which organizations were targeted, or what the exploit chain looks like. Secondary sources report the flaw was added to CISA’s Known Exploited Vulnerabilities catalog with a federal remediation deadline of October 16, 2026, but at least one tracker said it could not confirm the listing. Check the KEV catalog directly. The bug requires user interaction, so delivery is almost certainly phishing or social engineering.

MotW bypasses have a long record of use by ransomware affiliates and APT groups as a first-stage enabler, because they make the rest of a chain, such as a loader, a LNK file or a script, much more reliable.

Publicly disclosed zero-days

Two further bugs were publicly disclosed before patching, with no confirmed exploitation reported:

  • CVE-2026-108398: a .NET Framework bypass of Windows Defender Application Control (WDAC). Reported by a single source in our review, so verify against MSRC. A WDAC bypass matters most on hardened endpoints and servers that rely on allow-listing as a primary control.
  • CVE-2026-92707: a denial-of-service flaw in MessagePack-CSharp, also reported by a single source. Applications that deserialize untrusted MessagePack data should update the library as well as the OS.

Among the Critical bugs, one analysis highlights a CVSS 9.8 heap-based buffer overflow in the Raw Image Extension (CVE-2026-21413). It can be triggered by merely generating a thumbnail of a malicious RAW image, which makes it a zero-interaction vector on file servers and shared folders that render previews.

Impact

The exploited bug affects supported Windows client and server releases, and Microsoft’s single cumulative update covers it. The practical exposure is any user who can receive files from outside the organization. The volume matters too: with well over a thousand CVEs in one release, patch triage is a real constraint, and defenders should not let the record count delay the one confirmed zero-day. Windows 11 24H2 Home and Pro have also reached end of support, so those systems will not receive these fixes and must move to a supported release.

Mitigation

  1. Deploy the October 2026 cumulative update and restart. Prioritize internet-facing workstations, mail-handling users, VDI pools and jump hosts for CVE-2026-96951.
  2. Confirm the CISA KEV status and meet the October 16 deadline if you are a federal agency or follow BOD 26-04.
  3. Until patching completes, block or quarantine ISO, IMG, VHD, LNK and archive attachments at the mail gateway. Keep SmartScreen and Office Protected View enforced by policy.
  4. Hunt for files that arrived from the internet but lack a Zone.Identifier alternate data stream, and for execution of scripts or binaries from Downloads, temp and archive-extraction paths.
  5. On WDAC-dependent systems, patch the .NET Framework fix promptly and audit policies for permissive signer rules.
  6. Update MessagePack-CSharp in applications that handle untrusted input, and rebuild affected apps.
  7. Pull the raw image extension update on file servers and endpoints that render thumbnails.

References