Pierluigi Paganini October 14, 2026

Microsoft Patch Tuesday security updates for October 2026 address a record 1,415 vulnerabilities. Prioritize the exploited zero-day, critical bugs and potentially wormable vulnerabilities.

Microsoft just shattered every patch record in the book. October 2026 brought us a staggering 1,415 new CVEs from Microsoft alone.

“Well, it’s a new record release from Microsoft, again. This is also the first four-digit volume we have ever seen and includes six-digit CVEs. As always, counting this load is tricky, but I see 1,415 new CVEs from Microsoft. That puts this month at a greater volume than any previous YEAR from Microsoft. I’m starting to think I don’t like this new normal.” states ZDI. “As for the products affected by this release, we have Windows and Windows components, Office and Office Components, Developer Tools and .NET, SharePoint, Linux kernel, Skype for Business and Microsoft Lync, SQL Server and Dynamics, Azure and cloud services, and Exchange server.”

This is the first time Microsoft has reported more than 1,000 vulnerabilities in a single month. To help security teams handle this huge number of flaws, Microsoft introduced “risk cohorts” to group related vulnerabilities, similar to the old security bulletin system. AI is clearly helping researchers find bugs faster, both for attackers and defenders. The good news is that vulnerabilities are still being discovered faster than attackers are exploiting them. Security teams should focus on the most serious threats first instead of trying to patch every low-risk flaw at once.

Instead, focus immediately on what’s actively burning in the wild. The single zero-day under active attack this month is CVE-2026-96951, a Windows Shell security feature bypass used to dodge Mark of the Web protections.

“An attacker who successfully exploited the vulnerability could evade Mark of the Web (MOTW) defenses.” reads the advisory. “In an email or instant message attack scenario, the attacker could send the targeted user a specially crafted file that is designed to exploit the vulnerability. In any case an attacker would have no way to force a user to view attacker-controlled content. Instead, an attacker would have to convince a user to take action. For example, an attacker could entice a user to either click a link that directs the user to the attacker’s site or send a malicious attachment.”

Other high-priority threats include a critical unauthenticated SharePoint privilege escalation bug (CVE-2026-102866), a high-scoring SQL Server remote code execution flaw (CVE-2026-65674), and a massive wave of 59 potentially wormable vulnerabilities spanning core network services like DHCP, Remote Desktop Gateway, and DNS.

Below are the descriptions for the above issues:

• CVE-2026-96951 (CVSS score of 8.8) is a Windows Shell command injection vulnerability that allows an unauthorized attacker to bypass security protections over a network. Exploitation can evade Mark of the Web (MOTW) defenses, which help protect users from potentially dangerous files downloaded from the internet. Microsoft confirmed that the flaw is being actively exploited.
• CVE-2026-102866 (CVSS score of 8.1) is a Microsoft SharePoint Server vulnerability caused by improper verification of cryptographic signatures. It allows an unauthenticated attacker to elevate privileges over a network, potentially gaining unauthorized access to sensitive information or modifying data.
• CVE-2026-65674 (CVSS score of 8.8) is a Microsoft SQL Server remote code execution vulnerability caused by the deserialization of untrusted data. An authorized attacker with the required privileges could exploit the flaw over a network to execute code on the affected server.

“I may be wrong about some of these – there are a few where the description is somewhat…er…ambiguous, but regardless, this number of wormable bugs in 2026 should cause some level of concern. Not panic.” concludes ZDI. “There’s no need for that, but it is disconcerting to see this many juicy targets sitting out there. Please do your best to test and deploy these fixes in a timely manner.”

Prioritize the proven, public, and exploited flaws first, and take a deep breath before diving into the rest of the patch mountain. Make sure your operational priorities remain laser-focused on real risk rather than chasing vanity metrics.

Make every effort to test and apply these patches as soon as possible.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Patch Tuesday)