Microsoft released fixes for 1,411 CVEs on October 13 — more security updates in a single Patch Tuesday than the company published in the entire year of 2025.
Microsoft, AI-driven scanning, and the record haul
October’s Patch Tuesday set a new high-water mark: 1,411 vulnerabilities addressed, topping the records Microsoft itself set in July and September of 2026. By contrast, Microsoft released just over 1,100 updates in 2025. Company activity that began in July—when Microsoft warned customers to expect a deluge of patches—was tied to its use of a multi-model agentic scanning harness (MDASH) and other AI-driven techniques to find and fix vulnerabilities.
The actively exploited zero day: CVE-2026-96951
Among October’s disclosures was one vulnerability Microsoft says is being actively exploited in the wild: CVE-2026-96951, a Windows Shell security feature bypass with a CVSS score of 8.8. The flaw is described as having low attack complexity and requiring no authentication or existing privileges to exploit. Action1 director of vulnerability research Jack Bicer explained how attackers can abuse it: “Attackers can distribute specially crafted files through phishing emails, instant messages, or malicious websites, requiring only user interaction to trigger exploitation.” Bicer added that the vulnerability “can serve as an initial entry point in broader attacks by suppressing expected security warnings and allowing potentially malicious content to bypass protective checks.”
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogTwo publicly disclosed zero days: CVE-2026-108398 and CVE-2026-92707
Microsoft also applied its “zero day” label to two vulnerabilities that have been publicly disclosed but not (so far) observed exploited in the wild. CVE-2026-108398 is a .NET Framework security feature bypass with a CVSS score of 8.8 that allows authenticated, low-privileged attackers to bypass Windows Defender Application Control (WDAC) through an untrusted assembly search path. Action1 president Mike Walters warned that the issue “is particularly dangerous as a post-compromise attack technique, enabling attackers with existing local access to circumvent security restrictions without user interaction.” Walters noted there is no workaround available, Microsoft has labeled the flaw “exploitation more likely,” and he advised sysadmins to patch without delay.
The other publicly disclosed zero day, CVE-2026-92707, is a denial-of-service vulnerability in MessagePack-CSharp caused by an “improperly controlled sequential memory allocation in .NET” that “allows an unauthorized attacker to deny service over a network,” according to Microsoft.
Critical remote code execution bugs and the Outlook Reading Pane
October’s set included 70 critical vulnerabilities; 57 of those are remote code execution (RCE) flaws. One of the most alarming is CVE-2026-70242, a Reading Pane RCE bug in Outlook with a CVSS score of 9.8. Security vendor Automox described the issue bluntly: “A crafted email triggers a heap-based buffer overflow when Outlook shows it in the Reading Pane. The recipient doesn't open the message or click anything. No authentication, no user interaction.” Automox added context about why such bugs attract attention: “Preview-pane bugs surface every few years, and they draw attention because email is the front door. Addresses are easy to find in breach dumps and on company websites, so targeting costs an attacker almost nothing.”
What this means for UK CISOs, sysadmins, and attackers
- UK CISOs: Socura research published the same week found that a fifth (22%) of UK CISOs have called in sick or booked holiday time to avoid Patch Tuesday — a concrete sign that the sheer volume of updates is affecting workforce behavior and schedules.
- Sysadmins: With at least one actively exploited zero day, two publicly disclosed zero days labeled high-risk, and 57 RCEs among 70 critical bugs, sysadmins face urgent patching decisions. Action1’s Mike Walters explicitly advised sysadmins to patch CVE-2026-108398 without delay.
- Attackers and opportunists: The combination of low-complexity, no-authentication bugs (for example CVE-2026-96951) and an easy-to-target vector like email (CVE-2026-70242) creates low-cost opportunities for adversaries to exploit unpatched systems or use these flaws as stepping stones in broader campaigns.
Microsoft’s October release illustrates a broader operational question embedded in the numbers: AI and agentic scanning are surfacing more flaws than before, but the downstream burden rests with defenders. With a record 1,411 CVEs, at least one actively exploited zero day, multiple high-score vulnerabilities, and observable strain on security teams, the immediate imperative in the report is concrete and narrow—prioritize the high-risk, no-workaround issues and move quickly. As Action1 and Automox put it in plain terms, these are not academic: they are exploitable pathways and, until patched, practical tools for attackers.
https://www.infosecurity-magazine.com/news/microsoft-patch-tuesday-record-1/
