Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day
Microsoft’s October 2026 Patch Tuesday updates fix a record-breaking number of vulnerabilities, including a Windows zero-day exploited in the wild.
According to Microsoft, the latest updates resolve 1,413 CVEs, including 1,102 affecting Windows, 134 in Office, 61 in developer tools, and 36 in SharePoint Server. Exchange Server, Azure, Defender, and other products also received security patches.
This month alone, Microsoft patched more vulnerabilities than it did in all of 2025. The surge, largely driven by AI, has pushed the number of flaws fixed so far in 2026 past 4,000.
The exploited zero-day is tracked as CVE-2026-96951 (CVSS score 8.8/10). Microsoft describes it as a Windows shell security feature bypass flaw that enables an attacker to evade Mark of the Web (MotW) defenses.
MotW tags internet-downloaded files, signaling security mechanisms like Defender SmartScreen and Office Protected View to restrict automatic execution. Bypassing MotW allows malicious files to launch without triggering...
Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE
