1,413 fixes. Only a handful matter.
Microsoft’s October Patch Tuesday landed on October 13 with 1,413 CVEs, the largest monthly batch the company has ever shipped. September’s 974 already looked enormous at the time. This one blew past it.
Security researchers keep saying the count is theater, and they’re right. Fortra’s Tyler Reguly put it bluntly: 1,413 is no different from any other number. Of the thousands of flaws Microsoft patched this year, fewer than 1% are known to be exploited. What matters is which ones attackers are actually using. This month, that’s exactly one.
Windows absorbed the lion’s share at 1,102 flaws. Office took 134. The remainder scattered across SharePoint Server, SQL Server, Exchange, Azure, and Defender.
The zero-day attackers are already using
CVE-2026-96951, rated CVSS 8.8, is a command-injection flaw in Windows Shell that defeats Mark of the Web, the tag Windows stamps on files downloaded from the internet. Automox researchers described MOTW as the sticker every guard in the building checks. This bug delivers the package with no sticker attached. A downloaded file opens as though you created it locally, with no warning dialog, no read-only preview, and no macro block. SmartScreen, Office Protected View, and Smart App Control all get bypassed at once.
The discovery story has a 2026 flavor: Anthropic’s Claude AI helped find the flaw, working alongside Fujitsu researchers Riku Bamba and Yuya Chudo. Microsoft hasn’t disclosed who is exploiting it or how. But CISA added CVE-2026-96951 to its Known Exploited Vulnerabilities catalog on October 13, with remediation due by October 16.
Exploitation requires one thing from you: opening a crafted attachment or following an attacker-controlled link sent over email or messaging. If the file never gets opened, the bug never fires.
If you’re on Windows 11 24H2, this was your last update
Buried in the release notes is the bigger story for home users. October’s release was the final monthly security update for Windows 11 24H2 Home and Pro. From here on, no more patches. Every vulnerability discovered after this month stays open on 24H2 machines permanently.
The way out is an upgrade to 25H2 or 26H2. The updates themselves ship as KB5127648 for versions 24H2, 25H2, and 26H2, and KB5127646 for 26H1.
Update now. It takes five minutes.
- Open Settings and go to Windows Update.
- Click Download & install all.
- Restart when prompted. The update does not finish without a reboot, and a downloaded-but-unrebooted machine is still vulnerable.
- Back up anything important first. This batch also repairs black-screen crashes and VPN failures, but large updates occasionally break things, and a backup is cheap insurance.
If you look after machines for other people, family or a small office, verify theirs actually installed. Silence is not confirmation.
The other flaws worth a glance
You don’t need to memorize 1,413 CVEs. Four more deserve a sentence each:
- CVE-2026-70242 (CVSS 9.8): a critical Outlook Reading Pane RCE. A crafted email triggers it when Outlook merely previews the message. No opening, no clicking, no authentication.
- CVE-2026-105016 (CVSS 9.8): a heap buffer overflow in Microsoft QUIC. An unauthenticated attacker can run code over the network against Windows 11, Windows Server, .NET, and Visual Studio.
- CVE-2026-102866 (CVSS 8.1): a SharePoint elevation-of-privilege bug caused by improper cryptographic signature verification.
- CVE-2026-65674 (CVSS 8.8): a SQL Server RCE needing no user interaction. Check any SQL Server directly connected to the internet.
One honest footnote: some USB Audio Class 1.0 devices may still produce no sound or throw Code 10 errors after updating. Microsoft is still working on that one.
The pile keeps growing
CVE disclosures are up 145% in two years, and AI-assisted discovery is a big reason. Vendors find more, researchers find faster, and the monthly pile gets taller. The defense hasn’t changed: patch the exploited flaw today, patch the critical ones this week, and don’t run an operating system Microsoft has stopped feeding.
If an attack ever reaches you despite all that, our guide to what to do after a data breach walks through the exact steps, and our SSN-theft guide covers the worst case.
