Microsoft Fixes a Record 1,413 Flaws in One Month, Including an Exploited Windows Zero-Day; CISA Gives Federal Agencies an October 16 Deadline
Microsoft's October Patch Tuesday release on October 14 fixed 1,413 security vulnerabilities, a single-month record, according to SecurityWeek. Of those, 1,102 affect Windows, 134 affect Office, 61 affect developer tools and 36 affect SharePoint Server, with more than 70 rated Critical. Microsoft says it has now patched more than 4,000 flaws so far in 2026, a surge it attributes in large part to SI-assisted vulnerability discovery.
The most urgent item is CVE-2026-96951, a Windows Shell security-feature bypass with a CVSS score of 8.8 that Microsoft confirms has been exploited in the wild. The flaw evades Mark of the Web protections — the mechanism that tags files downloaded from the internet so that Defender SmartScreen warnings and Office Protected View apply; once bypassed, a malicious file may run without triggering those warnings. Microsoft says an attacker must persuade a user to open a specially crafted file or otherwise interact, and cannot force a user to view attacker-controlled content. The flaw was reported independently by researchers at Fujitsu and Anthropic and by an independent expert. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added it to its Known Exploited Vulnerabilities catalog and directed federal agencies to address it by October 16.
Two other flaws were publicly disclosed before fixes shipped: CVE-2026-108398, which can bypass Windows Defender Application Control and let unauthorized code run inside a protected process, discovered by James Forshaw of Google Project Zero; and CVE-2026-92707, a denial-of-service flaw in MessagePack-CSharp. Tallies vary slightly by counting method — some researchers counted 1,411 flaws — and this report uses Microsoft's figure of 1,413.
Sources: SecurityWeek reporting, October 14, 2026; TechRepublic reporting, October 14, 2026; Microsoft security advisories and the CISA Known Exploited Vulnerabilities catalog.
Published by GSM · USA (original Chinese edition)
Photo: 微软位于华盛顿州雷德蒙德市总部的92号楼（资料图）。图片来源：Wikimedia Commons，Coolcaesar 摄，CC BY-SA 4.0 授权
