Microsoft's October 2026 Patch Tuesday Addresses Record 1,413 Vulnerabilities, Including Actively Exploited Zero-Day

Microsoft's October 2026 Patch Tuesday is the largest in its history, fixing 1,413 vulnerabilities. This includes one actively exploited zero-day (CVE-2026-96951) in Windows Shell, which bypasses the Mark of the Web warning system, and two other publicly disclosed zero-days. The Cybersecurity and Infrastructure Security Agency (CISA) has added the exploited flaw to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch it by October 16, 2026. Critical remote code execution vulnerabilities were also addressed in Windows DHCP Server, Microsoft Outlook, and Microsoft Quick UDP Internet Connections (QUIC).