October 2026 Patch Tuesday: 1,411 fixes and counting

THREAT ADVISORY · 1MC-LABS TEAM · OCTOBER 13, 2026

The largest Patch Tuesday in 23 years. One zero-day being exploited right now, two more disclosed, 70 Critical bugs, and a twelve-month curve that says this is the new normal. Here is what to patch first, what we are hunting for, and the detection pack to go with it.

1,411 is not a typo

Microsoft shipped fixes for 1,411 vulnerabilities today. That is the largest Patch Tuesday in the 23 years the program has existed, and it beats the record that was set 35 days ago.

Seventy of them are rated Critical. Three are zero-days, and one of those is being used in attacks right now.

If you count by category, you get 677 privilege escalation bugs, 317 remote code execution bugs, 254 information disclosure bugs, 73 denial of service bugs, 40 security feature bypasses, and 28 spoofing flaws. And that tally only covers what dropped today. Microsoft fixed another 348 or so earlier in the month across Azure, Exchange, Dataverse, Bookings, and its own Linux distro, so the real October number is closer to 1,760.

Here is the part we actually want you to hear. The number is not the story. Less than one percent of what Microsoft patches in a given year ever shows up on the CISA Known Exploited Vulnerabilities list. Nobody has the staff to triage 1,411 CVEs one at a time, and you should not try. What you need is a short list of the ones that will hurt you, a reboot window for the boxes that matter, and somebody watching for the stuff you could not patch yet. The rest of this advisory is that short list, written for people who have to defend networks, not people who collect headlines.

The emergency board

If you read nothing else, read this board. It is ordered the way we would work it, top to bottom. Status is what Microsoft published as of the evening of October 13. Only one bug on this list is confirmed exploited. The rest earn their spot because nobody has to log in, nobody has to click, or the box they live on is the one that runs your network.

When CISA adds any of these to the Known Exploited Vulnerabilities catalog, the clock changes from this week to today. We will update this advisory as that happens.

A year ago this was a 63-bug month

Last November, Patch Tuesday was 63 flaws and one zero-day. A big month back then was anything over 100. Then the curve bent. April hit 167, June hit 200, July nearly tripled that at 570, September crossed 900, and October more than doubled again. Twelve months ago we were patching a few dozen bugs a month. Now we are patching more in one Tuesday than we used to patch in a year.

It is not a perfectly straight line. August dipped to 400 after July's 570, and that felt like a breather at the time. It was not. Every quarter since January has been larger than the one before it, and the last three months alone account for more fixes than the previous nine combined.

Why is this happening? Microsoft says it plainly. They are pointing AI at their own code to find and fix bugs, and so is everyone else, including the people on the wrong side of the fence. The bugs were always there. What changed is how fast somebody notices them. CVE counts across the whole industry are up roughly 145 percent in two years. This is the new baseline, not a spike, and if your patch process was built for 60 CVEs a month, it is now a process for a world that no longer exists.

The three zero-days, and the one that matters tonight

CVE-2026-96951, Windows Shell, exploited in the wild. This is the one. It is a Mark of the Web bypass, CVSS 8.8, and it is the second time this year the Windows Shell has been the site of an exploited zero-day. Mark of the Web is the little tag Windows sticks on anything that came from the internet, and nearly every downstream defense trusts that tag instead of inspecting the file. SmartScreen, Office Protected View, the macro block, Smart App Control, the attachment warning prompt. All of them check the sticker, not the package. This bug delivers the package without the sticker. A file the attacker crafted opens as if you built it yourself on your own desk. No warning, no read-only view, no macro block. One bug turns off five controls at once, and that is why someone is already using it.

Exploitation still needs a user to open the file or visit the site, so your phishing training is not wasted. But do not lean on it. Microsoft has not said how it is being exploited or by whom, and we are not going to guess for them. Patch it. Two notes for the folks running older gear: Windows Server 2012 does not get a fix for this one, only 2012 R2 does, and Microsoft says the flaw also touched Outlook.com, which was quietly fixed on their side a few weeks back.

CVE-2026-108398, .NET Framework, publicly disclosed. This one bypasses Windows Defender Application Control, which Microsoft now calls App Control for Business. An attacker who already has a low-privilege foothold drops a crafted .NET assembly and registers it to load inside a protected process, and WDAC waves it through. It needs local access, so it is a post-compromise move, not a front door. Microsoft rates it exploitation less likely. We rate it exactly the kind of thing a patient intruder keeps in their back pocket. If you went to the trouble of deploying application control, this is the bug that makes that work meaningless until you patch.

CVE-2026-92707, MessagePack-CSharp, publicly disclosed. A denial of service in a .NET serialization library. Rated Moderate. Patch it.

Patch these first

We sort by how an attacker reaches the bug, not by CVSS alone. A 9.8 that needs a logged-in admin is a smaller problem than an 8.8 that fires when someone scrolls past an email. Here is the order we would work in.

Tier 1: RIGHT NOW !

• CVE-2026-96951, Windows Shell. The exploited zero-day. Every workstation, every server someone browses or reads mail on.
• The five Outlook reading pane bugs: CVE-2026-70242, 70291, 88156, 97016, 97749. All CVSS 9.8, all remote code execution, and all trigger when Outlook renders the message in the preview pane. The user does not have to open the email. In some configurations Outlook will helpfully render it with no interaction at all. Email is the front door, and your addresses are already in every breach dump on earth, so targeting costs an attacker nothing. We have seen this movie before. CVE-2023-23397 was a no-click Outlook bug and it became a state actor favorite for a year.
• CVE-2026-70571, Exchange Server. Critical stack-based overflow, CVSS 8.1, and Microsoft marks exploitation more likely. Stack it with CVE-2026-96940, the Exchange privilege escalation that shipped out-of-band on October 2 and is also rated more likely. If you still run on-prem or hybrid Exchange, these go in the same window as the Outlook fixes.
• CVE-2026-70229, Active Directory Domain Services. Critical remote code execution on your domain controllers, incorrect authorization, CVSS 8.1, exploitation more likely. An RCE on a DC is a full-domain problem, so we do not care that it is not a 9.8.

Tier 2: this week, anything listening on a network port

• Microsoft QUIC, CVE-2026-105016 and CVE-2026-100219. Both 9.8, both unauthenticated, both one crafted packet. QUIC lives in Windows 11, Windows Server, .NET, and Visual Studio, so this is broader than it sounds.
• DHCP Server, CVE-2026-96934 (9.8) plus CVE-2026-88117, 88119, 88120, and 88171 (8.1 each). Five RCEs in a service every network depends on and nobody thinks about. If an attacker is already on your LAN, DHCP is a quiet way to own the box that hands out addresses.
• Message Queuing, CVE-2026-100202 (9.8) and CVE-2026-108460 (8.1). MSMQ is off by default. Check anyway, because it has a habit of being on.
• PostScript Printer Driver, CVE-2026-70147 and CVE-2026-70153. Both 9.8 heap overflows. Print servers are the forgotten children of the datacenter.
• Windows Text Shaping, CVE-2026-97814. 9.8 heap overflow in font rendering. Fonts reach you through documents and web pages, so this one is really a user-facing bug wearing a network bug's CVSS.
• Remote Desktop Services, CVE-2026-70187, and RD Gateway, CVE-2026-100218. If RDP or RD Gateway is exposed to the internet, you already know what to do, and you should have done it years ago.
• NDES, CVE-2026-69802. Critical RCE from weak authentication in the certificate enrollment service. If you issue device certs through NDES, that box is part of your identity plane.
• SQL Server, CVE-2026-65674. CVSS 8.8, deserialization, authenticated but no user interaction, and the highest exploitability rating of any SQL bug this month. Any SQL Server reachable from the internet goes first.
• SharePoint, CVE-2026-102866. Critical privilege escalation from a signature verification flaw. Steal a user's proof token, modify it, submit it, and you are that user. Tokens get stolen all the time, so do not shrug at the prerequisite.

Tier 3: this week, anything a human opens a file on

• Excel. Eighteen Critical remote code execution bugs this month, all CVSS 8.8, on top of CVE-2026-105718. One spreadsheet attachment is still the most reliable initial access technique in the business.
• Word CVE-2026-70300 (9.8), PowerPoint CVE-2026-88178 (9.8), and three Visio RCEs, CVE-2026-102855 through 102857. Office documents and mail clients account for 135 of this month's fixes. That is a whole Patch Tuesday from last year, inside one product family.
• Windows PDF CVE-2026-108457, HEVC Video Extensions CVE-2026-108400, Raw Image Extension CVE-2026-96202 and 96943, GDI+ CVE-2026-83934, Media Foundation CVE-2026-96952. File format parsers. A crafted image, video, or PDF in a browser tab or an email is the delivery vehicle.

Tier 4: before the end of the month, the ladder bugs

Six hundred seventy seven privilege escalation bugs is not a number anyone patches by hand. The ones that matter are the ones Microsoft rates exploitation more likely, because those are what an attacker chains after a phishing landing to get SYSTEM. Windows Kernel CVE-2026-96913, Graphics Kernel CVE-2026-88073, Common Log File System CVE-2026-70233, 85355, and 85870, the five VBS Enclave bugs, the three Hyper-V bugs including CVE-2026-105733 and 102214, and a pile of Win32k and Windows Update escalations. CLFS in particular has been a ransomware operator favorite for three years running. Skipping Tier 4 means skipping the back half of the attack chain.

Cloud: nothing to deploy, something to check

Microsoft already fixed Partner Center (CVE-2026-96207, a perfect 10.0), Bookings (9.9), Azure App Service (9.8), Dataverse (9.8), Azure SRE Agent, Event Grid, and API Center on their side. Your job is to confirm your tenant is not carrying leftover permissions or integrations that depended on the old behavior, and to read the advisories for anything that needs a config change.

The calendar got you too

October is also when a lot of things stop getting patches at all, and an unsupported box does not care how good your patch process is.

• Windows 11 24H2 Home and Pro took their last security update today. Move them to 25H2 or 26H2.
• Windows 10 Enterprise LTSB 2016 is done as of today.
• Windows 11 23H2 Enterprise, Education, and IoT Enterprise get nothing starting next month.
• Windows Server 2012 and 2012 R2 reach the end of the third and final year of paid Extended Security Updates on October 14. There is no year four. Server 2012 did not even get the Windows Shell zero-day fix this month, which should tell you how this ends.
• Office 2021, including the Long-Term Servicing Channel, retires October 14 with no ESU option.
• Windows Server 2022 moves to extended support. Security fixes continue, feature work does not.

Every one of those is a system that will still be sitting on someone's network in six months with a growing list of unpatched bugs. If you cannot replace it, isolate it and make sure somebody is watching it.

What we are doing about it, and what you should do

If you are a ThreatHunter.ai customer, here is where we are. Our hunters have the Windows Shell MOTW bypass and the Outlook preview pane bugs at the top of the board. We are watching for files that land without a Mark of the Web where one should exist, for Office and Outlook spawning things they have no business spawning, and for .NET assemblies loading into protected processes that did not load there last week. We are watching the DHCP, MSMQ, and QUIC services on every host we see, and we are watching your domain controllers harder than usual. If you have something in that Tier 1 list you cannot patch this week, tell us which host and why, and we will put eyes on it until you can. The rules we are running, the TTPs behind them, and the honest state of public intel are in the detection pack that follows, and the Sigma and KQL files are free to anyone who wants them.

If you are not a customer, do this in order:

1. Patch CVE-2026-96951 and the five Outlook bugs on every endpoint today. Reboot. Verify the build number, not just the KB.
2. Patch Exchange and domain controllers in the same window. Do not wait for Saturday.
3. Walk the Tier 2 list against what is actually listening on your network. If you do not know what is listening, that is the real finding.
4. Office, PDF, and image parsers across the fleet this week.
5. The more likely privilege escalations before month end.
6. Pull an inventory of everything that just went end of life above, and decide its fate before the next zero-day decides it for you.

Microsoft also introduced something new this month called risk cohorts, 15 groupings of related bugs meant to help you prioritize. Filesystems and storage got 136, Office documents and mail got 135, graphics and media got 131, kernel privilege boundaries got 109, and installation and update services got 103. Microsoft is clear that cohort size does not equal danger, and we agree. It is a helpful map, and it is still a map of 1,411 things.

The honest truth is that patch management was built for a world of 60 bugs a month, and that world is gone. The number will be bigger in November. It will be bigger again in December. You are not going to patch your way to safety one Tuesday at a time, and nobody serious is pretending otherwise. The only thing that scales with the curve is knowing which handful of bugs your attacker can actually reach, patching those first, and having somebody hunting for the attacker who got there before you did. That has been our whole job since 2007. It just got a lot louder.

Stay safe, patch the Shell bug, and go check your DHCP servers. You will find something.

Intel status

There are no public IOCs for any of the October bugs as of the evening of October 13. No hashes, no domains, no sample.

Microsoft published "Exploitation Detected" for the Windows Shell zero-day and nothing else about how it is being used, and nobody else has either. So this pack is behavior-based. It catches what the exploit has to do, not what the exploit looks like, which is the only kind of detection that survives the next variant anyway.

The prior art is what tells you the shape. This is the third exploited Mark of the Web bypass of 2026. CVE-2026-21510 in February and CVE-2026-32202 in April both landed in KEV, and both were delivered the same way: a phishing email or link carrying a shortcut, archive, or disk image, opened by a user, followed by a second-stage loader that ran without a SmartScreen or Protected View prompt. Until Microsoft says otherwise, assume 96951 is being used the same way.

TTPs we are hunting

The ten rules

None of these rules care whether Outlook or Exchange or DHCP is installed. They fire on what the exploit has to do after it works, or on what it does when it fails. A hash or a domain only catches the one sample somebody already saw. Behavior catches the variant nobody has seen yet.

The KQL file carries the same ten as Defender for Endpoint hunts, plus H1, the anti-join that finds files written by Outlook or a browser with no file-origin fields, which is the closest thing we have to a direct signal for the Shell bypass, and H10, a Defender Vulnerability Management query that lists every host still exposed to the top fourteen CVEs.

Deployment order

1. Rules 003 and 004 and KQL H1 tonight. This is the only coverage anyone has for the exploited zero-day.
2. Rules 001 and 002 tonight. Outlook reading pane.
3. Rules 008 and 009 on Exchange and domain controllers tonight.
4. Rule 007 on every DHCP, MSMQ, IIS, RD Gateway, NPS, and print host tomorrow.
5. Rules 005, 006, and 010 fleet-wide this week.

What you need turned on

Sysmon events 1, 7, 11, 13, and 15, with signature and hash fields populated. Windows System and Application logs forwarded. For Defender shops, the DeviceFileEvents, DeviceImageLoadEvents, DeviceRegistryEvents, DeviceEvents, and DeviceFileCertificateInfo tables.

What we will add

The moment Microsoft, CISA, or a credible responder publishes samples, hashes, or a delivery pattern for CVE-2026-96951, we will push indicator rules into this pack and into every customer tenant. Until then, behavior is the signal, and this is the behavior.