WASHINGTON, October 15, 2026 – IT administrators opened Tuesday’s Patch Tuesday release expecting a heavy workload. They got a record.
Microsoft released patches for 1,413 vulnerabilities in its enterprise products on Oct. 13, 2026, which is the highest number of security updates that Microsoft has ever released in a month.
The highest priority vulnerability is CVE-2026-96951, which is a security feature bypass vulnerability in Windows Shell with a CVSS score of 8.8. This vulnerability is actively exploited in the wild.
Why the Windows Bug Matters
This bug enables attackers to bypass Mark of the Web protections, which mark files downloaded from the internet and trigger warnings through Microsoft Defender SmartScreen and Office Protected View. In other words, a malicious file will have fewer of the safeguards that users usually count on.
According to Microsoft, an attacker will have to convince a user to open a crafted file or click on a link. In other words, there’s no way to make a person view attacker-controlled content. It restricts the risk, but it doesn’t negate it. Phishing is the delivery method.
CISA added the vulnerability to its Known Exploited Vulnerabilities list and asked federal agencies to patch their systems by October 16. Microsoft did not reveal anything about the perpetrators, targets, or extent of attacks.
A Record Release—and a New Normal
The sheer scale is impressive. The patches have fixed 1,102 vulnerabilities in Windows, 134 in Office, 61 in developer tools, 36 in SharePoint Server, and 22 in SQL Server, according to news. The number provided by CrowdStrike varies a little bit per product line because of how it counts the updates – 1,123 Windows patches and 179 Office patches.
Over 670 of the vulnerabilities are related to privilege escalation, over 300 to remote code execution, and around 250 to information disclosure. Elevation-of-privilege vulnerabilities have comprised 48% of the update, remote code execution 22%, and information disclosure 18%, CrowdStrike noted.
“Hundreds of CVEs in a single release used to be the exception; now it’s the baseline,” said Dustin Childs, head of Threat Awareness at the Zero Day Initiative. He argued that teams should prioritize proven, public, and actively exploited flaws rather than triaging by raw CVE counts.
Office and Email Risks
In addition, the new update resolves 20 remote code execution vulnerabilities with CVSS scores ranging from 7.5 to 9.8 found in Excel, PowerPoint, Visio, and Word. Six of these issues can be exploited via the Preview Pane, so users do not even have to open the malicious document to fall prey.
Another weakness is found in Outlook. Here, the company has fixed five Critical remote code execution vulnerabilities with CVSS scores of 9.8, as well as two vulnerabilities that can be attacked with the use of the Reading Pane, which does not even require any authentication or interaction from users.
There were also two critical issues resolved by Microsoft in their QUIC implementations, where each of them was rated 9.8, allowing unauthenticated attackers to execute code on services based on vulnerable libraries.
What Organizations Should Do
Prioritize where there is the most exposure: internet-connected machines, domain controllers, print servers, email infrastructure, and the endpoints where users are accessing email attachments. The exploit in the Windows Shell vulnerability needs to be prioritized, especially considering that CISA has established a deadline for remediation.
There was also the concept of risk cohort, which is Microsoft’s newest way of categorizing vulnerabilities, which would need the same level of customer analysis. Microsoft is very clear about calling it an initial step and not the final determination, where administrators still need to consider exploitation,
severity, attack vector, and user interaction. More than 4,000 vulnerabilities in Microsoft products have already been patched this year, while SecurityWeek mentioned that October alone has surpassed the number for all of 2025. The takeaway for the defenders is clear: The number of patches per month is not the story anymore; prioritization is.
