Microsoft's October release of 1,407 CVEs tops 2020's full-year record by 146

Microsoft released a record 1,407 CVEs on October Patch Tuesday, breaking the 2020 record of 1,261, a figure that was Microsoft's CVE total for the full year 2020.

The exploited zero day is CVE-2026-96951, a flaw that bypasses Mark of the Web (MotW) protections in Windows Shell, and it should be dealt with immediately.

Satnam Narang of Tenable noted this is the third Windows Shell flaw exploited in the wild this year; the others are CVE-2026-21510, linked to APT28 (Fancy Bear), and CVE-2026-32202, a known exploited vulnerability that was a fix for an incomplete patch for CVE-2026-21510.

Dustin Childs, head of threat awareness at TrendAI's Zero Day Initiative, said CSOs should take action on a SharePoint hole (CVE-2026-102866).

Tenable wrote that Microsoft addresses 1407 CVEs in the tenth Patch Tuesday of 2026, "marking the second consecutive month to reset the bar as the largest Patch Tuesday release."

In September 2026 Microsoft addressed 974 vulnerabilities across its products, including 723 Windows vulnerabilities.

October's patch batch dwarfs September's record of nearly 1,000 fixes.

Narang said: "There have been 26 Windows Shell vulnerabilities patched in 2026 through October, a staggering figure compared to previous years, with only three Windows Shell CVEs in 2025, and just one in 2024 and 2022."

Nightwing drew attention to four updates for on-premises Exchange Server, each fixing a single high-severity vulnerability with a CVSS score of 8.8.

Nicholas Carroll, Nightwing's cyber incident response manager, said: "Exchange admins should prioritize testing and deployment of these patches, given the historical track record of Exchange vulnerabilities being actively targeted in the wild."

October's 1,407 CVEs exceed Microsoft's 2020 full-year total of 1,261 CVEs by 146.

The 146-CVE excess is about 11.6 percent of Microsoft's 2020 full-year CVE total of 1,261.

26 Windows Shell CVEs patched in 2026 through October is about 8.7 times the three patched in 2025.

26 Windows Shell CVEs across ten monthly cycles (January to October) averages about 2.6 per month.

The October bugs include three zero-day vulnerabilities, one of which has been exploited.

A SharePoint zero day, CVE-2026-102866, lets unauthenticated attackers exploit cryptographic token validation flaws and hijack targeted user accounts.

Microsoft addressed 1,413 vulnerabilities in its October 2026 security update release, according to CrowdStrike.

Microsoft's October Patch Tuesday contained 1,413 defects affecting the company's enterprise products and services.

The third zero day, CVE-2026-108398, is an untrusted search path in the Windows .NET framework that lets an unauthenticated attacker bypass Windows Defender Application Control enforcement.

The list was so long that its release came several hours later than the usual 1 p.m. Eastern drop time, somewhat frustrating admins.

Atlassian CVE-2026-21589 affects eight self-hosted products including Jira, Confluence and Bitbucket; there are reports exploitation attempts began October 6, though attempts do not establish successful customer compromise.

Atlassian Cloud is patched and requires no user action; Nightwing advised reviewing access logs and rotating secrets where exposure is suspected.

Developers running self-managed GitLab instances should patch quickly to fix a flaw allowing an unauthenticated user to execute arbitrary code through a crafted regular expression in a CI/CD configuration; GitLab has remediated its hosted instance.

Gene Moody, Field CTO at Action1, said: "CVE-2026-97229 puts a critical part of the software supply chain at risk."

IBM warned of a critical flaw in IBM i versions 7.3, 7.4, 7.5 and 7.6, CVE-2026-96119, CVSS 9.9, allowing a remote authenticated attacker to execute arbitrary code via the HTTP Server Administration GUI.