Microsoft Patches a Record 1,413 Vulnerabilities: Why Prioritisation Matters More Than the Patch Count
On 13 October 2026 Microsoft patched 1,413 security vulnerabilities, its highest Patch Tuesday count ever. The number is alarming but the real message is different: what matters is not how many flaws there are but which one is being exploited. A plain prioritisation guide for businesses.
In brief: Microsoft patched a record 1,413 security vulnerabilities in its Patch Tuesday of 13 October 2026; the previous month was about 1,000. The Hacker News breakdown: Windows 1,102, Office 134, Developer Tools 61, SharePoint Server 36 and SQL Server 22. By type, over 670 are privilege escalation, over 300 remote code execution and 250 information disclosure; over 70 are rated Critical. Only one is exploited in the wild: a command injection in Windows Shell (CVE-2026-96951, CVSS 8.8) that can bypass “Mark of the Web” protections; CISA added it to the KEV catalog (deadline for federal agencies 16 October). The report cites AI-assisted bug hunting (on both offence and defence) as one reason for the surge. Lessons: prioritise by exploitability, not count; patch critical and exploited flaws urgently and move the rest to regular maintenance. Source: The Hacker News (26 October 2026).
Last updated: 26 October 2026
The numbers
| Product | Flaws fixed |
|---|---|
| Windows | 1,102 |
| Office | 134 |
| Developer Tools | 61 |
| SharePoint Server | 36 |
| SQL Server | 22 |
| Total | 1,413 (record; previous month about 1,000) |
By type: 670+ privilege escalation, 300+ remote code execution, 250 information disclosure. Over 70 are Critical. Tenable's Satnam Narang notes Microsoft has patched over 4,000 CVEs so far this year.
What is genuinely urgent
The flaws that stand out in the report:
- CVE-2026-96951, Windows Shell command injection (CVSS 8.8): Exploited in the wild. A specially crafted file (email, instant message, link or attachment) can bypass “Mark of the Web” protections. CISA added it to KEV; the patch deadline for federal agencies was 16 October. Who is using it, and against whom, is unclear.
- CVE-2026-108398, .NET Framework (CVSS 8.8): Publicly known at release. It lets an authenticated local attacker bypass Windows Defender Application Control and run code in a protected process. (In the report this flaw's ID appears mixed up with another CVE; confirm in Microsoft's update guide.)
- CVE-2026-21413, Raw Image Extension (CVSS 9.8, non-Microsoft): A heap overflow that can be triggered when Windows generates a thumbnail or preview; the user doesn't have to open the file.
- Other Critical and RCE flaws on internet-facing and widely used systems.
Why was the record broken? The role of AI
The report attributes the rise partly to AI-assisted bug hunting. In ZDI's Dustin Childs's reading, the issue is less the count than discovery outpacing exploitation. That matches the other events of this month: the AI-assisted discovery of PHP2Shell. Microsoft also introduced “risk cohorts” to group CVEs that need similar assessment.
What does it mean for businesses?
1. “Patch everything immediately” doesn't work as volume grows
Applying thousands of fixes a month quickly isn't realistic. The right method is prioritisation: flaws that are exploited, publicly known, remotely triggerable and affecting internet-facing systems come first.
2. A simplified order for small businesses
- Keep automatic updates on (Windows Update, Office); for most businesses this is the best first step.
- Check exploited flaws (CISA KEV list); ask your software team/IT provider to compare your patch status with that list.
- Patch servers (SharePoint, SQL Server, Exchange etc.) before workstations.
- Test critical applications after patching.
- Replace unsupported Windows versions in a planned way.
3. Watch out for email- and file-based attacks
The exploited Windows Shell flaw uses files that arrive by email or message. Remind staff not to open suspicious files and keep corporate email filters and endpoint protection up to date.
6 questions about patch management
- Which Windows, Office and server versions do we use? Are all still supported?
- Has the CVE-2026-96951 patch been applied?
- How often are servers such as SharePoint and SQL Server patched?
- Is the CISA KEV list checked regularly?
- What tests are run after patching?
- Is there a time commitment in the contract for urgent patches? See our maintenance and SLA guide.
For the month's other patches see our October patch scorecard.
Security-focused maintenance with Aktaş Digital
We set up inventory, prioritisation and testing routines for software and infrastructure maintenance. To discuss the security and maintenance status of your systems, use our quote form.
Frequently Asked Questions
Are all 1,413 flaws exploited?
No. In the report only one flaw (CVE-2026-96951) is confirmed exploited in the wild; another was publicly known at release.
Should I install everything immediately?
Automatic updates are best for most users. On servers and critical systems, follow a quick schedule after testing; don't wait on exploited flaws.
Did AI really cause this increase?
The report attributes the rise partly to AI-assisted bug hunting; exact causation is an expert reading, not a proven measurement.
What is Mark of the Web?
A Windows mechanism that tags files downloaded from the internet and shows extra warnings. Bypassing it can let a malicious file run without a warning.
Conclusion
The record patch count is a reason not for panic but for prioritisation discipline. Patch exploited and remotely triggerable flaws first, keep automatic updates on and set a written patch deadline. The first thing you can do today: ask your IT provider in writing whether the CVE-2026-96951 patch has been applied.
