Microsoft’s October 2026 security release fixes about 1,400 vulnerabilities, a new record, including a Windows Shell zero-day that attackers are already using to get round Mark of the Web. Several widely used products also received their last security update, so for many UK IT teams this month is as much about lifecycle as it is about patching.
What happened
Microsoft released its monthly security updates on Tuesday 13 October 2026. The vulnerability count is roughly 1,400, but researchers disagree on the exact number. Tenable and Ivanti both put it at 1,407 CVEs. BleepingComputer counts 1,411 and says it leaves out another 348 flaws Microsoft fixed earlier in the month. Tenable notes it is the second record-breaking month in a row.
One flaw is confirmed as exploited in the wild: CVE-2026-96951, a security feature bypass in Windows Shell. A second, CVE-2026-108398, is a .NET Framework bypass of Windows Defender Application Control (WDAC). Its details were made public before a fix was available. BleepingComputer credits the .NET discovery to James Forshaw of Google Project Zero. It also lists a MessagePack-CSharp denial of service bug (CVE-2026-92707) as publicly disclosed.
The vendors also disagree on how many flaws are rated Critical: 69 (Tenable), 70 (BleepingComputer) or 78 (Ivanti). Most of the critical ones are remote code execution bugs.
The technical picture
CVE-2026-96951 has a CVSSv3 score of 8.8. Microsoft classes the root cause as command injection in Windows Shell, and the result is that a file can skip the Mark of the Web (MOTW) checks. MOTW is the tag Windows adds to downloaded files, and it triggers SmartScreen and Office Protected View. Tenable says exploitation would normally depend on persuading someone to open a malicious file sent by email or message. This is the third Windows Shell flaw exploited in the wild this year, after CVE-2026-21510 in February and CVE-2026-32202 in April. Ivanti says Windows Server 2012 R2 to 2025 is affected, as are Windows 10 and 11.
CVE-2026-108398, also rated 8.8, is a weakness in how the .NET Framework searches for files to load. A local attacker who already has an account can register a crafted .NET assembly so that a protected process loads it. That lets them run code that WDAC policy should have blocked. Microsoft says no user interaction is needed. Ivanti lists .NET Framework versions 4.6.2 to 4.8.1, plus 3.5, as affected.
The bugs that most need attention in on-premises estates are not the zero-days. Microsoft rates the following as “Exploitation More Likely”:
- CVE-2026-70229 is a critical remote code execution flaw in Active Directory Domain Services (CVSSv3 8.1). It is triggered by a crafted network packet.
- CVE-2026-70571 is a critical remote code execution flaw in Exchange Server. It can be triggered by a malicious email that the server processes through its internal content conversion. Ivanti says it affects Exchange 2016 and 2019.
- CVE-2026-70279 is an Exchange spoofing flaw scored 9.3, the highest among Tenable’s highlighted bugs. It relies on a user, ideally an administrator, clicking a link.
To help with the sheer volume, Microsoft has started grouping related flaws into 15 experimental “risk cohorts”. Microsoft stresses they are not a severity ranking.
Why it matters for UK organisations
A Mark of the Web bypass undermines the controls most UK organisations rely on to stop phishing attachments. Awareness training teaches staff to heed warning banners, and email security setups often assume Windows will display them. If a malicious file opens without that prompt, the user loses their last chance to stop and think.
The Exchange and Active Directory flaws matter because on-premises Exchange is still common in UK local government, the NHS, education and mid-sized firms. According to Ivanti, the last paid support period for on-premises Exchange and Skype for Business servers ends on 31 October. Organisations that are still running Exchange 2016 or 2019 have this fix and only a few more weeks of support before the patches stop.
The lifecycle changes are significant. This was the final security update for Windows 11 24H2 Home and Pro, Office 2021, Office LTSC 2021 and its Mac edition, Skype for Business LTSC 2021, and Windows 10 Enterprise LTSB 2016. Tenable reports that Extended Security Updates for Windows Server 2012 and 2012 R2 have now ended. Windows Server 2022 has moved into extended support, which continues until October 2031. Unsupported software cannot meet the Cyber Essentials security update management requirement, so any of these products still in scope for certification is now a compliance problem as well as a security one.
Expert view
The headline number is useful mainly as a warning that monthly patching no longer works the way it used to. BleepingComputer links the rising volume to Microsoft’s use of AI tools to find and fix bugs, and that trend is unlikely to reverse. No team can triage 1,400 CVEs individually. The work is to make sure the update pipeline actually deploys patches, and then to put human effort into the small number of flaws that are exposed and being exploited.
In my experience, Mark of the Web bypasses are a favourite of initial access brokers because they make old techniques work again. When we test phishing resilience, much of the protection comes from controls that depend on MOTW: Protected View, macro blocking for internet files and SmartScreen. Remove that tag and little may stand between a ZIP file and code running on the desktop.
The WDAC bypass is easy to underrate because it needs local access. But application control is often the control organisations use to contain a foothold, and a public bypass gives attackers already inside a way past it. For domain controllers, an “Exploitation More Likely” network-reachable remote code execution flaw should be patched in days, not weeks.
What to do now
- Patch CVE-2026-96951 on every Windows endpoint and server first. Cyber Essentials requires critical and high-risk updates within 14 days, and an exploited zero-day should not wait anywhere near that long.
- Update domain controllers and Exchange servers next for CVE-2026-70229, CVE-2026-70571 and CVE-2026-70279, then check that no Exchange management interface is reachable from the internet.
- Deploy the .NET Framework updates for CVE-2026-108398 on any system where WDAC is part of your control set, and review which accounts can register assemblies.
- Add layers that do not depend on MOTW. Block or quarantine archive and disk image attachments at the email gateway, apply attack surface reduction rules, and make sure endpoint detection alerts on Office or Explorer launching script hosts.
- Run a lifecycle sweep. Find Windows 11 24H2 Home and Pro, Office 2021, Windows 10 LTSB 2016 and Windows Server 2012 or 2012 R2 hosts. Upgrade them, isolate them or take them out of your Cyber Essentials scope.
- Plan your Exchange exit before support ends on 31 October. Record any exceptions in your risk register.
Bottom line
October’s record release is mostly routine work for a well-run patch pipeline, apart from one exploited Windows Shell flaw that weakens a key phishing defence and a set of Exchange and Active Directory bugs that attackers are likely to target. Patch those first, use the end-of-support dates to remove legacy systems, and do not let the size of the release delay the parts that matter.
