.jpg)
Microsoft broke records yet again on October 13, releasing more security updates for this month’s Patch Tuesday than in the whole of 2025.
The tech giant fixed 1411 CVEs for October, an all-time high that beat the records it set in July and September this year. By contrast, it released just over 1100 updates in 2025.
The surge in volume can be traced to Microsoft’s use of AI to find and fix vulnerabilities in its products.
Back in July it warned customers to expect a deluge of patches, thanks in part to its use of multi-model agentic scanning harness (MDASH) technology.
The increased workload for security teams is already having an impact. Socura research published this week found that a fifth (22%) of UK CISOs have called in sick or booked holiday time to avoid Patch Tuesday.
Read more on Microsoft's AI warnings: Microsoft: AI Cuts Post-Compromise Attack Time to Minutes.
The October 2026 haul included one actively exploited and two publicly disclosed zero day vulnerabilities.
The former is CVE-2026-96951, a Windows Shell security feature bypass vulnerability which could lead to malware exposure, data compromise, system integrity violations and operational disruption.
It has a CVSS score of 8.8, involves low attack complexity, and requires no authentication or existing privileges to exploit.
“Attackers can distribute specially crafted files through phishing emails, instant messages, or malicious websites, requiring only user interaction to trigger exploitation,” explained Action1 director of vulnerability research, Jack Bicer.
“The vulnerability can serve as an initial entry point in broader attacks by suppressing expected security warnings and allowing potentially malicious content to bypass protective checks.”
Two New Zero Days Identified
Microsoft also applies the “zero day” label to any vulnerabilities that have been publicly disclosed but not yet exploited in the wild.
One such flaw this month is CVE-2026-108398, a .NET framework security feature bypass vulnerability with a CVSS score of 8.8. It allows authenticated, low-privileged attackers to bypass Windows Defender Application Control (WDAC) through an untrusted assembly search path, according to Action1 president, Mike Walters.
“This vulnerability is particularly dangerous as a post-compromise attack technique, enabling attackers with existing local access to circumvent security restrictions without user interaction,” he explained.
“Successful exploitation could compromise system integrity, expose sensitive business information, weaken endpoint defenses and disrupt critical operations.”
With no workaround available and Microsoft labelling this one “exploitation more likely,” sysadmins should patch without delay, Walters advised.
The second publicly disclosed zero day this month is CVE-2026-92707, a denial-of-service flaw in MessagePack-CSharp.
Microsoft explained that an "improperly controlled sequential memory allocation in .NET allows an unauthorized attacker to deny service over a network."
Of the 70 critical vulnerabilities posted this month, most (57) are remote code execution (RCE) flaws. Among the most noteworthy is CVE-2026-70242, a Reading Pane RCE bug in Outlook with a CVSS score of 9.8.
“A crafted email triggers a heap-based buffer overflow when Outlook shows it in the Reading Pane. The recipient doesn't open the message or click anything. No authentication, no user interaction,” warned Automox.
“Preview-pane bugs surface every few years, and they draw attention because email is the front door. Addresses are easy to find in breach dumps and on company websites, so targeting costs an attacker almost nothing.”
Image credit: wutianzeri / Shutterstock.com
.jpeg)
