Microsoft's October 2026 Patch Tuesday Addresses Record 1,413 CVEs, Including Actively Exploited Windows Shell Zero-Day

Microsoft has released its largest-ever Patch Tuesday, fixing 1,413 vulnerabilities, with a critical focus on CVE-2026-96951, an actively exploited zero-day in Windows Shell that bypasses the Mark of the Web warning system. The Cybersecurity and Infrastructure Security Agency (CISA) has added this flaw to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch by October 16, 2026.