Microsoft's October 2026 Patch Tuesday fixes 1,413 CVEs, the largest single security update it has ever shipped and a jump from September's 974. Eighty are rated critical. Two are zero-days, and one of those is already being exploited.
The record number is also the least useful thing in the release. Tyler Reguly of Fortra pointed to a figure that carries more weight: 26 of this year's Microsoft CVEs have landed in CISA's Known Exploited Vulnerabilities catalog, down from 30 last year and 32 the year before. Less than 1% of what Microsoft has patched in 2026 is known to be exploited in the wild. The count going up does not mean your exposure is going up with it.
Where the bugs live: Windows took 1,102 of them, followed by Office (134), Developer Tools (61), SharePoint Server (36), SQL Server (22), Azure (15), Exchange Server (7), and Defender (4), with 32 in other categories. Microsoft also republished a Cisco Talos finding, CVE-2026-21413, a raw image extension RCE.
The exploited zero-day
CVE-2026-96951 (CVSS 8.8) is the one being used in the wild. It sits in Windows Shell and was found by Anthropic's Claude. It targets Mark of the Web, the tag Windows stamps on files that come from the internet so later defenses know to treat them with suspicion. SmartScreen, Office Protected View, the Office macro block, Smart App Control on Windows 11, and the Attachment Manager prompt all read that tag before deciding how to handle a file.
The bug lets an attacker deliver a file that never gets the tag. Automox described MOTW as a sticker every guard in the building checks instead of inspecting the package itself; this bug hands over a package with no sticker. The file opens as though the user created it locally. No warning dialog, no read-only view, no macro block. One flaw switches off several controls at once, which is why a single MOTW bypass is worth more than its CVSS score suggests.
The second zero-day, CVE-2026-108398 (CVSS 8.8) in .NET Framework Security, is a smaller problem. It needs local access and a low-privilege account, and Microsoft rates it "exploitation less likely." Automox describes it as an untrusted search path: an attacker drops a crafted .NET assembly on the endpoint, registers it to load into a protected process, and runs code there without tripping Windows Defender Application Control. Action1's Mike Walters flagged its value as a post-compromise technique against WDAC-protected environments and noted there is no official workaround, so the patch is the mitigation. Watch unpatched systems for suspicious assembly loading.
The rest worth prioritizing
A few others are worth pulling forward regardless of the headline count.
CVE-2026-70242 (CVSS 9.8) is a Reading Pane RCE in Outlook. A crafted email triggers a heap-based buffer overflow when Outlook renders it in the preview pane, with no need to open the message, authenticate, or interact at all. Addresses are cheap to find in breach dumps and on company sites, so targeting costs an attacker almost nothing.
CVE-2026-105016 (CVSS 9.8) is a heap-based buffer overflow in Microsoft QUIC, unauthenticated and over the network. A single crafted packet can give code execution, and it spans Windows 11, Windows Server, .NET, and Visual Studio.
CVE-2026-65674 (CVSS 8.8) is a SQL Server RCE through deserialization of untrusted data. An authenticated connection sends a crafted request and runs code on the server with no user interaction. ZDI's Dustin Childs called it the best exploitability rating of any SQL Server bug this month and said to check it on any SQL Server exposed to the internet.
CVE-2026-102866 (CVSS 8.1) is a SharePoint elevation of privilege from improper cryptographic signature verification. An attacker who holds a valid proof token for a target user can modify it and authenticate as that user. Obtaining the token is the hard part, Childs noted, but there are several ways to do it.
On the operational side, Nightwing's advice is to patch Exchange, .NET, and Windows 11 outside the normal maintenance cadence. Four Exchange updates (KB5129955/56/57/58) each carry a single High-severity CVSS 8.8 CVE across Exchange 2016, 2019, and Subscription Edition; given Exchange's track record as a target, treat them as near-critical. Nightwing also flags the October 2 Exchange update for CVE-2026-96940 on all on-prem and hybrid servers, and warns that Windows 11 24H2 Home/Pro are on their final security update, so migrations should start now. For Windows 11, KB5127648 and KB5126653 align 24H2, 25H2, 26H2, and 23H2 on the same security content; track build numbers in compliance reporting, not just KB presence.
Why the numbers keep climbing
The 1,413 figure fits a trend. Echo's analysis puts monthly CVE disclosures up 145% in two years, from 3,173 in June 2024 to 7,765 in June 2026, and annual totals at 30,949 in 2023 and 49,979 in 2025, with 2026 on track to pass that. Some of that is CVE program expansion, some is AI-assisted bug hunting.
Childs puts the AI question plainly: partly to blame, since it speeds discovery on both sides, but it is not manufacturing bugs that were not already there. It shortens the gap between a vulnerability existing and someone noticing it. Discovery is scaling faster than exploitation, so teams that triage by raw CVE count instead of exploitability spend effort on the wrong bugs. Patch what is proven, prioritized, and public, and treat the rest as the new baseline.
Top comments (0)