Microsoft’s October 2026 Patch Tuesday landed on October 13 with a record load: 1,413 vulnerabilities fixed in a single release, according to CrowdStrike’s rolling tally, with security firm Tenable counting 1,407 and Rapid7 putting the Windows-only share at 1,102. Buried inside that pile is one bug that matters more than the rest. CVE-2026-96951, a security-feature-bypass flaw in Windows Shell, is already being exploited in the wild, and it is the third Windows Shell zero-day to see active abuse so far in 2026.
The release also carries two publicly disclosed zero-days that had no patch available at the time attackers could have started probing them, plus critical flaws in SharePoint, Exchange Server, and Active Directory Domain Services. For IT teams already stretched by a chained zero-day in Ivanti Connect Secure and a wave of other October disclosures, this is the month vulnerability counts stopped being a background statistic and became a scheduling problem.
October 2026 Patch Tuesday by the numbers
Different vendors count CVEs differently, and this month’s figures show why that matters. CrowdStrike’s analysis puts the total at 1,413 vulnerabilities addressed, including 75 rated critical, one exploited zero-day, and two zero-days disclosed publicly before a fix shipped. Tenable’s own count lands at 1,407 CVEs, with 69 rated critical and 1,337 rated important. Rapid7 and ITBrief reported 1,102 of the fixes apply strictly to Windows components, meaning the remainder spans Office, SQL Server, Exchange, Azure components, and third-party drivers bundled into the release.
Tenable’s blog post on the release called this the second consecutive month that Patch Tuesday reset the bar for the largest release of the year, which means September 2026 had already broken the prior record before October broke it again. That trend line, two record months back to back, is itself a data point worth tracking heading into November.
Patches arrived later than usual too. CSO Online noted the release dropped after the typical 1 p.m. Eastern cutoff, a delay that annoyed administrators who build their patch windows around that schedule and now had less runway before end of business.
CVE-2026-96951: the Windows Shell zero-day under active attack
CVE-2026-96951 carries a CVSSv3 score of 8.8 and is rated important rather than critical, a rating gap that security researchers flagged as misleading given it is already being weaponized. The flaw lets an attacker bypass Windows’ Mark of the Web protections in Windows Shell, the layer that normally flags files downloaded from the internet as potentially unsafe before a user opens them.
Exploitation does not require a network foothold. A victim only has to open a specially crafted file or land on an attacker-controlled site, according to IT Brief’s reporting on the disclosure. Once Mark of the Web is bypassed, Windows skips the warning dialog that would otherwise interrupt a user before a malicious document or script runs, which is exactly the kind of low-friction entry point ransomware crews and initial-access brokers favor.
Satnam Narang, senior staff research engineer at Tenable, told CSO Online that CVE-2026-96951 marks the third Windows Shell flaw exploited in the wild this year. The prior two were CVE-2026-21510, which researchers tied to the APT28 group (also tracked as Fancy Bear), and CVE-2026-32202. Narang’s team also pointed out that Windows Shell produced three exploited CVEs in 2025, compared with just one each in 2024 and 2022, a pattern suggesting attackers have settled on this component as a reliable way into target machines.
The other two zero-days: SharePoint and .NET Framework
CVE-2026-102866 affects SharePoint and stems from a cryptographic token validation flaw, according to CSO Online. The bug lets an unauthenticated attacker hijack a targeted user’s account without needing valid credentials first, which is a serious escalation path for any organization running SharePoint as an internal collaboration hub tied into single sign-on.
The third zero-day, CVE-2026-108398, hits the .NET Framework through an untrusted search path weakness. Tenable’s writeup describes the exploitation chain in detail: an attacker registers a malicious .NET assembly that gets loaded by a protected process, and once that happens, Windows Defender Application Control enforcement can be bypassed entirely. That matters because Application Control is the exact mechanism many enterprises rely on to block unauthorized executables from running in the first place. A flaw that defeats it quietly removes a safety net without the admin noticing until something else goes wrong.
Both CVE-2026-102866 and CVE-2026-108398 were publicly disclosed before Microsoft had a patch ready, which gave attackers a window to study the bugs openly while defenders had nothing to deploy yet. Microsoft has not confirmed either was exploited before patching, but public disclosure ahead of a fix is treated by most incident response teams as equivalent risk to a confirmed zero-day, since proof-of-concept code tends to follow within days.
Exchange Server and Active Directory round out the critical list
Beyond the three zero-days, Tenable flagged several additional CVEs it considers high priority for enterprise patching. CVE-2026-70229 is a remote code execution flaw in Windows Active Directory Domain Services, carrying a CVSSv3 score of 8.1 and a critical rating. Microsoft’s own Exploitability Index marks it “Exploitation More Likely,” and the attack path only requires sending a crafted packet to a vulnerable AD DS service, no credentials needed.
Exchange Server picked up two notable bugs. CVE-2026-70279 is a spoofing vulnerability scored at 9.3 that relies on social engineering, an attacker convinces a target to click a malicious link, and from there can access or modify organizational data if the victim holds administrative privileges. CVE-2026-70571 is a remote code execution flaw scored at 8.1, triggered when a vulnerable Exchange server processes a malicious email through its internal content-conversion pipeline. Neither requires the attacker to already be inside the network, which is why Exchange-facing organizations tend to prioritize these patches even when other CVEs carry higher raw severity numbers.
October 2026 Patch Tuesday: the headline CVEs at a glance
| CVE | Component | CVSSv3 | Status | Attack requirement |
|---|---|---|---|---|
| CVE-2026-96951 | Windows Shell | 8.8 | Exploited in the wild | Open a malicious file or site |
| CVE-2026-102866 | SharePoint | Not disclosed | Publicly disclosed, no confirmed exploitation | None, unauthenticated |
| CVE-2026-108398 | .NET Framework | 8.8 | Publicly disclosed, no confirmed exploitation | Register a malicious assembly |
| CVE-2026-70229 | Active Directory Domain Services | 8.1 | Exploitation more likely | Send a crafted network packet |
| CVE-2026-70279 | Exchange Server | 9.3 | Exploitation more likely | Social engineering, link click |
| CVE-2026-70571 | Exchange Server | 8.1 | Exploitation more likely | Malicious email processed by server |
Figures sourced from Tenable’s and CSO Online’s analyses of the October 2026 release. CVSS scores for the SharePoint flaw had not been publicly disclosed in vendor advisories at the time of writing.
Why the CVE count keeps climbing
A release north of 1,400 fixes sounds alarming on its face, but several security researchers pushed back on treating the raw number as a meaningful risk signal. Narang told CSO Online he has long argued that vulnerability counts alone are close to meaningless, and this month’s total of 1,413 does not change that view. What he considers meaningful instead is the share of patched CVEs that actually show up in CISA’s Known Exploited Vulnerabilities catalog, the list the US government maintains of flaws confirmed to be under real-world attack.
By that measure, 26 Microsoft CVEs have landed in the CISA KEV catalog so far in 2026. That compares with 30 last year and 32 the year before, a gradual decline even as total patch volume keeps rising. Narang’s math works out to less than 1% of everything Microsoft patches this year being confirmed as exploited, which reframes the story: the count is inflated partly because Microsoft and its partners now disclose far more dependency and driver-level CVEs than in prior years, not because Windows itself is becoming proportionally less secure.
Microsoft CVEs confirmed in CISA’s KEV catalog by year
| Year | Microsoft CVEs added to CISA KEV | Change from prior year |
|---|---|---|
| 2024 | 32 | Baseline |
| 2025 | 30 | Down 2 |
| 2026 (year to date) | 26 | Down 4 so far |
Data per Satnam Narang of Tenable, cited by CSO Online. The 2026 figure covers January through the October release and will likely rise before year end as more of this month’s bugs get weaponized.
How this compares to October’s other vendor disclosures
Microsoft was far from the only vendor dropping urgent patches this week. Ivanti disclosed a zero-day in Connect Secure that researchers at Volexity said an attacker chained with two other flaws to gain root access without logging in, and only two of the three bugs in that chain had patches available when the advisory went out. SonicWall is dealing with a maximum-severity CVSS 10.0 flaw now under active attack, and Citrix NetScaler customers blew past a CISA remediation deadline on a 9.5-rated bug of their own.
CSO Online’s roundup noted that CSOs also had to juggle vulnerabilities in Atlassian, Adobe, IBM, and SAP products the same week Microsoft’s release landed. Atlassian’s own CVSS 9.3 flaw hit eight products at once, and attackers were already targeting self-hosted Atlassian instances before most customers had a chance to patch. Compared with those vendors, Microsoft’s disclosure process looks relatively structured, monthly, predictable, with advance notice through its Exploitability Index, even if the sheer volume this month strained patch management teams that also had to triage half a dozen other urgent advisories in the same 72-hour window.
The contrast matters for budget conversations. Enterprises that lean on CVSS scores alone to triage patching would have ranked CVE-2026-70279’s 9.3 score above CVE-2026-96951’s 8.8, yet the lower-scored Windows Shell bug is the one already being exploited. That gap is the clearest argument for weighting CISA KEV status and real-world exploitation signals above raw CVSS severity when deciding what gets patched first.
End of support adds urgency for legacy Windows Server shops
Tenable’s advisory also flagged lifecycle deadlines that compound the patching pressure. Windows Server 2012 is reaching end of support, and Windows Server 2022 is losing mainstream support, meaning organizations still running either version lose access to the free security updates that would normally cover flaws like the ones disclosed this month. Several other Microsoft products are hitting end-of-support milestones around the same window, according to Tenable, which pushes some IT teams toward emergency migration projects rather than a routine patch cycle.
That timing is not a coincidence industry analysts expect to go away. Legacy infrastructure running end-of-life operating systems is consistently the softest target in enterprise networks, and attackers know lifecycle calendars as well as defenders do. A Windows Server 2012 box still running past its support date, with no patch for anything resembling CVE-2026-70229, is a liability that outlasts any single Patch Tuesday.
What security teams should patch first
Given the scale of this release, most incident response teams will not patch all 1,413 CVEs in one pass. Prioritization logic that security teams are applying this week looks roughly like this, based on the combined guidance from CrowdStrike, Tenable, and CSO Online’s reporting:
- CVE-2026-96951 first, since it is confirmed exploited and requires only a user opening a file or visiting a page
- CVE-2026-102866 and CVE-2026-108398 next, since both were disclosed publicly before a patch existed and proof-of-concept code tends to follow quickly
- Internet-facing Exchange Server and Active Directory Domain Services instances, given CVE-2026-70279, CVE-2026-70571, and CVE-2026-70229 all carry Microsoft’s “Exploitation More Likely” assessment
- Any system still running Windows Server 2012 or approaching the end of Windows Server 2022 mainstream support, which needs a migration plan rather than a patch
- The remainder of the 1,413-bug backlog, triaged by asset exposure rather than CVSS score alone
For organizations managing patch compliance across large fleets, a quick way to confirm exposure on a given endpoint is to check installed updates directly rather than waiting on a dashboard refresh.
# Check whether a specific October 2026 security update is installed
# Replace KBXXXXXXX with the KB number listed in Microsoft's advisory for the CVE you're tracking
Get-HotFix -Id "KBXXXXXXX" -ErrorAction SilentlyContinue
# Pull all updates installed in the last 7 days across a remote fleet via WSUS/Intune reporting
Get-HotFix | Where-Object { $_.InstalledOn -gt (Get-Date).AddDays(-7) } | Sort-Object InstalledOnHistorical context: a year of record Patch Tuesdays
Tenable’s framing of October as “the second consecutive month” to set a new size record implies September 2026 already broke the previous high before October broke it again. Microsoft’s monthly release has grown steadily in scope over the past several years as the company folds in more third-party driver CVEs, Azure component fixes, and dependency-chain disclosures that previously would not have been counted in the same bucket. That expansion inflates the headline number without necessarily reflecting a proportional rise in exploitable risk, which is the exact point Narang was making with his CISA KEV comparison.
What has not changed is the recurring presence of Windows Shell on the exploited list. Three straight years of at least one exploited Shell CVE, climbing to three in a single year in 2025, suggests attackers found a durable foothold in a component that touches nearly every user interaction with the file system. Microsoft has shipped defense-in-depth changes to Shell before, but each fix so far has been narrowly scoped to the specific bypass technique rather than the underlying trust model that Mark of the Web depends on.
Market and industry impact
Patch Tuesday releases of this size feed directly into the business case for vulnerability management and patch orchestration vendors. Tenable, Rapid7, CrowdStrike, and similar firms all published same-day analyses this month, a predictable cadence that doubles as marketing for their respective platforms, but it also reflects real demand: enterprise security teams increasingly cannot triage four-digit CVE counts manually and lean on these vendors’ prioritization scoring to cut through the noise.
The broader pattern, more CVEs disclosed per release, a shrinking share of them actually exploited, also strengthens the argument for exposure-based and threat-intelligence-driven patching over blanket CVSS triage. Security teams that built their patch prioritization purely around CVSS scoring are the ones most likely to have under-ranked CVE-2026-96951 this month, since an 8.8 score sits below a dozen other bugs in the same release that are not currently being exploited at all.
Predictions for the weeks ahead
- CISA will likely add CVE-2026-96951 to its Known Exploited Vulnerabilities catalog within days, following the pattern set by the two prior exploited Windows Shell CVEs this year
- Expect proof-of-concept exploit code for CVE-2026-102866 and CVE-2026-108398 to surface publicly within one to two weeks, given both were disclosed ahead of patches
- Organizations still running Windows Server 2012 will face growing pressure to migrate, and some will likely pay for Extended Security Updates rather than complete the move in time
- Expect at least one more vendor, following Atlassian, SonicWall, Citrix, and Ivanti, to disclose a critical or actively exploited flaw before the month ends, continuing October’s unusually dense cluster of disclosures
- Microsoft’s total CVE count for 2026 will likely finish higher than 2025’s full-year figure, even as the share of those bugs confirmed exploited keeps trending down
FAQ
How many vulnerabilities did Microsoft patch in October 2026?
CrowdStrike’s count puts the total at 1,413 vulnerabilities, while Tenable’s own analysis counts 1,407. The gap comes down to differences in how each firm classifies and groups related CVEs.
What is CVE-2026-96951?
It is a security-feature-bypass flaw in Windows Shell, scored 8.8 on CVSSv3, that lets an attacker bypass Mark of the Web protections and avoid the warning Windows normally shows before opening a file downloaded from the internet. Microsoft has confirmed it is being exploited in the wild.
Is CVE-2026-96951 the only zero-day in this release?
No. Two additional zero-days, CVE-2026-102866 in SharePoint and CVE-2026-108398 in the .NET Framework, were publicly disclosed before Microsoft shipped a patch, though neither has a confirmed case of active exploitation.
Should I prioritize patches by CVSS score?
Not exclusively. CVE-2026-96951 carries a lower CVSS score (8.8) than several other bugs in this release, including the 9.3-rated Exchange Server spoofing flaw, yet it is the one under active attack. Security researchers recommend weighting confirmed exploitation and CISA KEV status above raw CVSS severity.
How many Microsoft CVEs have been added to the CISA KEV catalog in 2026?
26 so far this year, according to Tenable’s Satnam Narang, down from 30 in 2025 and 32 in 2024, even as total patch volume has grown.
Does this release affect Windows Server 2012 and 2022?
Windows Server 2012 is reaching end of support and Windows Server 2022 is losing mainstream support around this release, according to Tenable, meaning organizations on either version should treat migration as urgent rather than optional.
What other vendors issued critical patches this same week?
Ivanti, SonicWall, Citrix, and Atlassian all disclosed critical or actively exploited vulnerabilities in the same window as Microsoft’s October release, adding to the overall patching burden on security teams.
Where can I check if a specific CVE from this release affects my systems?
Microsoft’s Security Update Guide lists every CVE from the release with affected product versions and the corresponding KB article. Tools like Tenable, Rapid7, and CrowdStrike also publish free summaries that map each CVE to exploitability status.
