Microsoft has released its largest Patch Tuesday security update, fixing 1,413 vulnerabilities across Windows and other products, including a Windows security flaw already being exploited in real-world attacks. The October 2026 release also addresses critical vulnerabilities in Outlook, Exchange Server, and networking components that could allow attackers to execute malicious code on affected systems.
Released on October 13, the updates cover 1,102 vulnerabilities in Windows, 134 in Microsoft Office, 61 in developer tools, 36 in SharePoint Server, and 22 in SQL Server, according to Microsoft’s Security Update Guide.
More than 670 vulnerabilities involve privilege escalation, while over 300 could enable remote code execution. The release surpasses Microsoft’s previous monthly record set in September, marking the second consecutive month in which the company has issued an unprecedented number of security fixes.
Windows Zero-Day Already Under Attack
The most urgent vulnerability, tracked as CVE-2026-96951, affects Windows Shell and carries a CVSS severity score of 8.8 out of 10.
Microsoft confirmed that attackers exploited the flaw before a patch became available. Successful exploitation allows an attacker to bypass Mark of the Web (MOTW), a Windows security mechanism that identifies files downloaded from potentially untrusted sources and helps trigger security warnings.
An attacker could exploit the weakness by persuading a victim to open a specially crafted attachment or visit a malicious website. Although user interaction is required, bypassing MOTW can undermine protections such as Microsoft Defender SmartScreen, potentially allowing malicious files to run without the expected warnings.
Microsoft credited researchers from Fujitsu and Anthropic, along with an independent researcher, for reporting the flaw. The company has not publicly identified the attackers, their targets, or the techniques used in the observed exploitation.
Two other vulnerabilities were publicly disclosed before patches became available, although neither was reported as actively exploited.
One, CVE-2026-108398, affects the .NET Framework and could allow an authenticated attacker to bypass Windows Defender Application Control restrictions and execute unauthorized code. The other, CVE-2026-92707, affects the MessagePack-CSharp data serialization library and could allow specially crafted input to exhaust application memory, resulting in a denial of service.
Critical Outlook Flaws Could Allow Code Execution Through Email Previews
Beyond the exploited vulnerability, Microsoft’s October update addresses five critical remote code execution flaws in Outlook, each assigned a CVSS score of 9.8.
The vulnerabilities, tracked as CVE-2026-70242, CVE-2026-97749, CVE-2026-97016, CVE-2026-88156, and CVE-2026-70291, could potentially be exploited through specially crafted email messages.
According to security firm Rapid7, all five vulnerabilities can be triggered through Outlook’s Reading Pane, meaning a malicious email could potentially execute code when previewed without requiring the recipient to open an attachment or click a link.
Depending on Outlook’s configuration, the message preview may appear automatically, further reducing the interaction needed for a potential attack.
Microsoft has not reported active exploitation of these vulnerabilities, and its assessments indicate that exploitation is less likely. Nevertheless, their potential to execute code through email previews makes them particularly relevant to organizations that rely heavily on Outlook.
The release also addresses critical vulnerabilities affecting enterprise infrastructure.
Among them is CVE-2026-70571, a remote code execution vulnerability in Microsoft Exchange Server, and CVE-2026-70229, which affects Active Directory Domain Services.
Both received critical severity ratings and were assessed by Microsoft as having a higher likelihood of exploitation, although neither was reported as actively exploited.
Additional critical vulnerabilities affect Microsoft’s QUIC networking implementation, including CVE-2026-100219 and CVE-2026-105016. Both carry CVSS scores of 9.8 and could potentially allow remote code execution against vulnerable services processing specially crafted network traffic.
Another notable fix addresses CVE-2026-21413, a critical vulnerability in the Windows Raw Image Extension. The flaw could allow malicious code execution when Windows generates a thumbnail or preview of a specially crafted RAW image file, even without the user explicitly opening the image.
Microsoft Introduces New Approach to Security Update Prioritization
The record-breaking release comes as Microsoft expands its use of artificial intelligence to identify and remediate software vulnerabilities, contributing to a substantial increase in the number of security issues disclosed throughout 2026.
The growing volume of patches also presents challenges for organizations that must evaluate potential exposure, test updates, and determine which vulnerabilities require immediate attention.
Alongside October’s fixes, Microsoft introduced an experimental approach called risk cohorts, which groups vulnerabilities according to shared deployment conditions and security considerations.
Rather than treating each vulnerability as an entirely separate assessment, the approach allows security teams to evaluate groups of flaws that raise similar questions about system configuration, exposure, and attack paths.
Microsoft emphasized that the groupings are exploratory and do not replace individual vulnerability assessments or existing patching guidance.
For organizations managing affected systems, the immediate priority is the actively exploited Windows Shell vulnerability, followed by other critical flaws according to exposure, exploitability, and the services deployed in their environments.
Windows users can obtain the latest security fixes through Windows Update, while enterprise administrators should consult Microsoft’s Security Update Guide for applicable patches, deployment instructions, and product-specific requirements.
Leave a Reply