Microsoft’s latest patch Tuesday addresses over 1,400 CVEs with one exploited zero-day (CVE-2026-96951). This marks the second month in a row with a record number of findings.
The Zero Days
The headline finding is a Windows Shell security feature bypass with a CVSS of 8.8. In this attack, social engineering is used to encourage a victim to open a malicious file. This then bypasses Mark of the Web (MotW), so the file runs without the usual security warnings.
This is the third Windows Shell flaw that has been exploited this year. February’s CVE-2026-21510 and April’s CVE-2026-32202 precede this finding.
A second zero-day is also addressed within this batch: CVE-2026-108398. This is a .NET Framework flaw that was publicly disclosed before a fix was released. This allows an attacker to bypass Windows Defender Application Control (WDAC). Microsoft has not reported any exploitation.
The Critical Flaws
Beyond the zero-days, several critical flaws deserve attention.
- Exchange (CVE-2026-70571) is an RCE from a malicious email, which Microsoft classifies exploitation as “more likely”.
- AD DS (CVE-2026-70229) is a code execution on AD from a crafted network packet.
- Wormable 9.8s affects QUIC (CVE-2026-100219) and DHCP Server (CVE-2026-96934).
Another Record Breaking Month
October sees another sharp climb in volume of CVEs identified. Microsoft fixed 58 vulnerabilities in February 2026, with this figure building to 972 by September. This figure increased again by over 40% to 1415 in October. This latest figure exceeds the total patched CVEs in all of 2023 (where 914 were fixed).
The Zero Day Initiative (ZDI) has linked this increase to the impact of AI speeding up the process of finding vulnerabilities. Rather than this increase in CVEs reflecting a more dangerous environment, it shows that vulnerabilities can be identified faster.
The flip side of this is that attackers can find the vulnerabilities faster too.
The real problem then, for defenders, is not that headline volume figure, but the challenge of effectively triaging the threats. Focus on zero-days and critical vulnerabilities first, then look to your environment to identify where your biggest risks are.
