Microsoft’s October 2026 Patch Tuesday updates fix a record-breaking number of vulnerabilities, including a Windows zero-day exploited in the wild.
According to Microsoft, the latest updates resolve 1,413 CVEs, including 1,102 affecting Windows, 134 in Office, 61 in developer tools, and 36 in SharePoint Server. Exchange Server, Azure, Defender, and other products also received security patches.
This month alone, Microsoft patched more vulnerabilities than it did in all of 2025. The surge, largely driven by AI, has pushed the number of flaws fixed so far in 2026 past 4,000.
The exploited zero-day is tracked as CVE-2026-96951 (CVSS score 8.8/10). Microsoft describes it as a Windows shell security feature bypass flaw that enables an attacker to evade Mark of the Web (MotW) defenses.
MotW tags internet-downloaded files, signaling security mechanisms like Defender SmartScreen and Office Protected View to restrict automatic execution. Bypassing MotW allows malicious files to launch without triggering warnings.
“In an email or instant message attack scenario, the attacker could send the targeted user a specially crafted file that is designed to exploit the vulnerability,” the tech giant explained in its advisory. “In any case an attacker would have no way to force a user to view attacker-controlled content. Instead, an attacker would have to convince a user to take action.”
The issue was independently reported to Microsoft by researchers at Fujitsu, Anthropic, and an independent expert. No information has been shared about the zero-day attacks, but threat actors often exploit these types of MotW bypass vulnerabilities in their campaigns.