Microsoft released fixes Tuesday for more than 1,400 security vulnerabilities across Windows, Office and its other products, including a Windows flaw that attackers are already using to slip malicious files past the warnings meant to stop them. The volume turns monthly patching into a capacity problem for IT teams, which must now decide which fixes go first.

What Happened

Microsoft's own security update data for October list more than 1,400 vulnerabilities to which Microsoft itself assigned a tracking number, known as a CVE, plus hundreds more in third-party components it ships, such as Linux packages. Outside tallies differ by method. BleepingComputer counted 1,411, leaving out 348 fixes Microsoft released earlier in the month, and Tenable researcher Satnam Narang told Krebs on Security that the batch beats the 1,261 CVEs Microsoft fixed in all of 2020.

The flaw under attack, CVE-2026-96951, sits in Windows Shell, the part of Windows that handles files and folders. Microsoft rates it Important, scores it 8.8 out of 10 for severity and marks it "Exploitation Detected." It lets attackers evade Mark of the Web, the tag Windows attaches to files that arrive from the internet or by email so that Windows and Office warn the user or open the file in a restricted mode. According to Microsoft's advisory data, an attacker would send a crafted file by email or instant message and would still need to persuade the target to open it or click a link.

RelatedSuspected Chinese Spies Exploited BeyondTrust Remote Support Flaw Since August, Google Says

Microsoft has not said who is exploiting the flaw or how widely. It credits two researchers at Fujitsu, a researcher listed as using Anthropic's Claude, and a fourth finder identified only by a handle.

The Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its catalog of known exploited vulnerabilities Tuesday, alongside an Ivanti Connect Secure bug. The catalog entry gives federal civilian agencies until Friday, Oct. 16, to fix it, and CISA's directive also expects them to check whether systems were compromised before the patch went on.

Two other flaws were made public before fixes were ready, though neither is known to be exploited. One, CVE-2026-108398 in the .NET Framework, can let code get around Windows Defender Application Control, a feature that limits which programs may run; BleepingComputer credits it to James Forshaw of Google Project Zero. The other, CVE-2026-92707, is a denial-of-service bug in the MessagePack-CSharp library.

Why It Matters

For many companies the most urgent fix may be CVE-2026-70242, a critical Outlook flaw scored 9.8. Microsoft says that simply viewing a crafted message in the Outlook Reading Pane could trigger it, with no click required. Microsoft rates exploitation less likely, but security company Automox noted that email addresses are easy to find, according to Infosecurity Magazine, so targeting costs attackers little.

The size of the release is the larger management issue. BleepingComputer counted 70 critical flaws, 57 of them allowing remote code execution, while Krebs on Security put the critical count at 78 or more. Krebs reported that September's batch of nearly 1,000 fixes was already about 10 times Microsoft's usual monthly load, and that Microsoft credits large language models for much of the discovery volume. Infosecurity Magazine noted that October alone exceeds the just over 1,100 updates Microsoft issued in all of 2025. Microsoft has described its own AI bug hunting as a source of the rise.

Fortra's Tyler Reguly told Krebs that only 26 Microsoft flaws have reached CISA's exploited list this year. "Security leaders should focus on exploitable risk," he said.

Microsoft offered its own triage aid. In a blog post titled "Using Risk Cohorts to Prioritize Security Updates," it grouped this month's flaws into 15 experimental "risk cohorts" that share a question about a customer's setup, such as 135 flaws in Office documents and mail clients and 65 tied to remote access. Microsoft says the groupings are not official categories and do not change its update guidance, and that the approach may become more useful as AI-assisted research finds more bugs.

What to Watch

The federal deadline for the Windows Shell flaw is Friday, and details on who is exploiting it would help companies judge their exposure. Narang said 2026 has already passed 4,000 Microsoft CVEs with two months to go, so November's release will show whether this volume is the new normal. October was also the final update for Windows 11 version 24H2 Home and Pro and for Windows 10 Enterprise LTSB 2016, BleepingComputer reported, and Windows 11 23H2 Enterprise and Education follow in November.