Microsoft's October Patch Tuesday includes 1,413 flaws and two zero-days, one under active exploitation

Microsoft released its October 2026 Patch Tuesday on Tuesday, October 13, addressing 1,413 vulnerabilities across Windows, its servers, and the broader software stack. It is officially the largest security release Microsoft has ever published, according to BleepingComputer, and it includes two public zero-days and a third zero-day currently under active exploitation in the wild. The sheer volume has made it the most consequential patch cycle of the year for enterprise IT teams and defenders.

The scale of the October release

The 1,413 count includes roughly 70 vulnerabilities rated Critical by Microsoft, a figure that has drawn immediate attention from security researchers and analysts. CrowdStrike notes that the release spans the Windows operating system, the .NET runtime, Visual Studio, Azure services, and several enterprise and server components. The four-digit CVE count is unprecedented for a single Patch Tuesday, effectively meaning Microsoft is closing the gap on its long backlog of unpatched code while simultaneously shipping fixes for newly reported flaws.

The release also marks the first time in at least two decades that Microsoft bundled a patch for a flaw in the .NET Framework itself that affects the base operating system. Historically, .NET Framework vulnerabilities have been addressed through separate cumulative updates, but CVE-2026-108398 lands directly in the OS patch cycle because the flaw is embedded in the Windows installation. The NVD entry, published on October 13 at 19:18 UTC, describes it as an untrusted search path in the .NET Framework that allows an authorized attacker to bypass a security feature locally, with a CVSS 8.8 score of 8.8 and an affected version range of .NET Framework 3.5 through 4.7.2.

Three zero-days, one under active attack

The most urgent fix in the release is CVE-2026-96951, an information-disclosure bug in the Windows Shell that CISA added to its Known Exploited Vulnerabilities catalog. CISA has flagged it as the highest-priority item, and CrowdStrike observed active exploitation attempts in the hours immediately after patch availability. Attackers are using it as a stepping stone: exploiting the shell flaw to gain initial code execution, then chaining into a second bug to escalate privileges and move laterally across a network.

A second publicly disclosed zero-day, CVE-2026-108398, affects the .NET Framework 3.5 through 4.7.2 on Windows 10 and Server 2016 through 2022. The flaw stems from an untrusted search path that allows an authorized attacker with local access to bypass Windows Defender Application Control (WDAC), a security feature many organizations rely on to restrict which executables can run. CrowdStrike describes it as a WDAC bypass. The attack path assumes the attacker already has local access and can choose which executable to launch, making it a particularly effective component in a staged, multi-stage attack chain.

The third publicly disclosed zero-day this month is CVE-2026-92707, a denial-of-service vulnerability in the MessagePack-CSharp library. While less dramatic than the other two, it is notable because it affects a widely used serialization library in .NET application development, and Microsoft disclosed that it has no patch available as of this release.

Why the WDAC bypass matters most for defenders

WDAC is the backbone of modern Windows application control. Organizations that deploy WDAC policies expect that only signed, approved executables will run on their machines, blocking unsigned malware and unapproved scripts. CVE-2026-108398 breaks that expectation: an attacker who already has a foothold on the machine can now run arbitrary code without tripping WDAC restrictions, effectively neutralizing one of the strongest application-layer defenses available on Windows.

For red teams, this is a force multiplier. The flaw does not require internet access or remote code execution; it only requires local execution, which ransomware-as-a-service operators and fileless malware families can obtain through a simple phishing payload or a stolen credential. Once the attacker is inside, they can drop and run unsigned tools, load custom loaders, or execute memory-only payloads that would normally be blocked. For blue teams, the patch is urgent but the risk window remains for any unpatched machine that has already been compromised.

What this means for you

Sources: CrowdStrike - October 2026 Patch Tuesday: Updates and Analysis; BleepingComputer - Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days; SANS ISC - October 2026 Microsoft Patch Tuesday.

Corrections: Report an error at corrections@wireshaman.com.