Source: SecurityWeek
Microsoft’s October 2026 Patch Tuesday resolved 1,413 CVEs, a single-month record, including 1,102 affecting Windows, 134 in Office, 61 in developer tools and 36 in SharePoint Server, with further patches for Exchange Server, Azure and Defender. The surge, driven largely by AI-assisted code analysis and the growing Microsoft product surface, pushed the number of flaws fixed in 2026 past 4,000, and this month alone exceeded all of 2025.
The zero-day that matters most
The actively exploited flaw is CVE-2026-96951, a Windows Shell security feature bypass with a CVSS score of 8.8 that lets attackers evade Mark of the Web protections. When MotW is bypassed, a malicious file downloaded from the internet can launch without triggering Defender SmartScreen or Office Protected View warnings. Attackers typically deliver it by convincing a user to open a crafted file sent by email or instant message. CISA added the bug to its Known Exploited Vulnerabilities catalog on patch day and instructed federal agencies to remediate by 16 October, which means the exploitation window for unpatched estates is closing fast. Two other flaws, a Windows Defender Application Control bypass and a DoS bug in the MessagePack-CSharp component used by Visual Studio and .NET, were publicly disclosed before fixes were available.
How to prioritise when the list is this long
With more than 1,400 CVEs a month, raw CVSS sorting no longer works as a strategy. Microsoft’s new risk cohorts aim to help, grouping CVEs by the assessment question they raise for customer environments, but CISA’s KEV catalog, exposure and exploitability data should drive the actual patch order. Internet-facing Windows endpoints, Exchange and SharePoint deserve the first slots, followed by anything used by administrators. If your patch cycle is measured in weeks rather than days for internet-facing systems, October is a good moment to reconsider it.
If you want help building a patch prioritisation process that scales to record-size updates, or an assessment of which of these CVEs actually affect your estate, contact Excello Digital at https://excello.digital/contact/. We help European organisations patch the right things first, with an audit trail their regulators accept.