Microsoft Ships 1,408 October CVE Fixes as 1 Windows Shell Flaw Faces Active Exploitation
Updated
Updated · Computerworld · Oct 16
Microsoft Ships 1,408 October CVE Fixes as 1 Windows Shell Flaw Faces Active Exploitation
3 articles · Updated · Computerworld · Oct 16
Summary
1,408 CVEs landed in Microsoft’s October Patch Tuesday—the biggest release of 2026—with 72 rated critical and CVE-2026-96951 already exploited in the wild.
1,122 of the flaws hit Windows, where the exploited Shell bug bypasses Mark of the Web and can trick users into opening crafted internet-downloaded files; CISA added it to its known exploited list on Oct. 13.
Patch guidance puts Windows, Office, Exchange and developer tools on a Patch Now schedule, while SQL Server can follow a standard rollout because none of its 22 CVEs is critical.
Windows 11 updates also carry a new known issue: non-admin users may fail to open Remote Desktop sessions to devices with Administrator protection enabled, prompting Microsoft to advise testing remote access before broad deployment.
The release also marks multiple support and enforcement milestones, including end of support for Office 2021 and final October updates for Windows Server 2012 and 2012 R2 Extended Security Updates.