Microsoft patches 1,413 flaws as exploited Windows bug emerges

Microsoft has issued fixes for 1,413 vulnerabilities in its October 2026 security update, the largest Patch Tuesday release identified in the source report. One of the flaws, a Windows Shell command-injection issue tracked as CVE-2026-96951, is being exploited in the wild. ¹²

What Microsoft fixed

The release covers 1,102 Windows flaws, 134 in Office, 61 in Developer Tools, 36 in SharePoint Server and 22 in SQL Server, according to the security update breakdown. More than 70 of the vulnerabilities are rated Critical, while privilege escalation, remote code execution and information disclosure make up the largest categories. ¹

Microsoft says CVE-2026-96951 can let an unauthorised attacker bypass Mark of the Web protections. The attack still requires a victim to open a malicious file or follow a link, but the company says the vulnerability has already been exploited. CISA has added it to its Known Exploited Vulnerabilities catalogue and set a 16 October deadline for US federal agencies to apply the fix. ¹³

The update also includes CVE-2026-108398, which Microsoft says can allow an authenticated attacker to bypass Windows Defender Application Control and run unauthorised applications without user interaction. A separate vulnerability, CVE-2026-21413, affects Raw Image Extension and could trigger remote code execution when Windows generates a thumbnail or preview for a malicious RAW image. ¹

Microsoft is also introducing risk cohorts, which group related CVEs to help organisations prioritise their response. The company says the groups are a starting point rather than a replacement for checking exploitability, severity, attack vector, user interaction and product-specific guidance. ¹

Our opinion

The headline number is eye-catching, but it is not the most useful way to triage this release. Organisations should start with the Windows Shell flaw because Microsoft says it is already under attack, then check the publicly known issues and the RAW Image Extension bug against the software and file-handling workflows they actually run.

That approach also explains why Microsoft’s risk-cohort idea matters. A list of 1,413 CVEs is too large to treat as a single emergency, while an exploited Windows flaw can be missed if teams prioritise only by severity score. The sensible response is not to ignore the volume, but to turn it into a ranked patching queue built around active exploitation and exposure.