Published on October 14, 2026 · The mitza.es team
Microsoft released its monthly security bulletin on October 13, 2026, and it has once again broken its own record, this time by a huge margin: more than 1,400 vulnerabilities fixed in a single month. The largest bulletin until now was September's, with 966 flaws, and according to Security Affairs it is the first time Microsoft has gone past a thousand in the same month. Among all those patches, one is already being used against real systems.
How many vulnerabilities exactly
It depends on who is counting. BleepingComputer puts the bulletin at 1,411 flaws, not counting another 348 fixed earlier in the month. SecurityWeek reports Microsoft's own figure, 1,413 CVEs, of which 1,102 affect Windows, 134 Office, 61 development tools and 36 SharePoint Server. And Security Affairs, citing Zero Day Initiative, speaks of 1,415. Each outlet counts slightly differently, but no difference changes the conclusion: it is an unprecedented volume. SecurityWeek calculates that this single month exceeds the total for all of 2025 and takes the 2026 running total above 4,000.
Of all of them, 70 are rated critical according to BleepingComputer (57 remote code execution, 11 elevation of privilege and 2 spoofing), although other outlets count up to 80. By type, elevation of privilege flaws predominate (around 677), followed by remote code execution (around 317).
The active zero-day: a shortcut around Mark of the Web
This is CVE-2026-96951, a security feature bypass in the Windows Shell with a CVSS score of 8.8 that Microsoft confirms as exploited. It allows Mark of the Web to be bypassed, the tag Windows adds to files downloaded from the Internet or received by email so that they warn you before running. With the flaw, a crafted file can be opened without those warnings.
To exploit it, the user has to be convinced to open the file, for example by sending it by email or messaging. Microsoft has not explained how it is being exploited; SecurityWeek reports that it was disclosed by Fujitsu, Anthropic and an independent researcher. CISA has added it to its catalog of exploited vulnerabilities and has given US federal agencies until October 16 to fix it. It is the kind of flaw that fits email fraud: a PDF or a compressed file that would previously have triggered a Windows warning and now does not.
Two more zero-days and flaws worth watching
Besides the exploited one, Microsoft counts as zero-days two other flaws that were publicly disclosed before the patch, with no confirmed exploitation:
- CVE-2026-108398: a security bypass in .NET Framework that allows Windows Defender Application Control (WDAC), the system that decides which applications can run, to be bypassed. According to BleepingComputer it was found by James Forshaw of Google Project Zero, and Microsoft considers its exploitation unlikely.
- CVE-2026-92707: a denial of service in MessagePack-CSharp, a component used by Visual Studio and .NET. It is of moderate severity.
Among the rest, the lists from BleepingComputer and Security Affairs highlight a critical remote code execution flaw in Active Directory Domain Services (CVE-2026-70229), an unauthenticated elevation of privilege in SharePoint Server (CVE-2026-102866, CVSS 8.1), a remote code execution flaw in SQL Server (CVE-2026-65674, CVSS 8.8) and 59 potentially "wormable" flaws, that is, able to spread on their own, in network services such as DHCP, Remote Desktop Gateway and DNS. If you don't manage your own servers, most of these don't affect you directly; if you do, they are the ones to schedule first.
Why there are so many patches at once
BleepingComputer and SecurityWeek attribute a good part of the record to the use of artificial intelligence to discover vulnerabilities, although neither source offers a breakdown that proves it. Microsoft has also introduced 15 "risk cohorts" to help prioritize installation, though it clarifies that these groups do not indicate which flaws are the most dangerous. For a small business the practical consequence is clear: at this monthly volume, manually checking what has been installed and what hasn't is no longer realistic.
The same bulletin ends support for Windows 11 24H2
October's update is also the last one for Windows 11 24H2 Home and Pro and for Windows 10 Enterprise LTSB 2016, according to BleepingComputer. Windows 11 23H2 Enterprise, Education and IoT Enterprise will stop receiving security updates in November 2026. We have already explained who is affected and what to do in our article on the end of support for Windows 11 24H2 and Office 2021; and if you still keep machines on Windows 10, also review what options you have with ESU updates.
What to do in your business this week
- Install October's cumulative updates on all machines, starting with the administration and invoicing ones, which are the ones that open the most external files.
- Be wary of unexpected files even if Windows shows no warning: with this flaw, the absence of a warning is no longer a sign that the file is safe.
- If you use Windows servers (DNS, DHCP, Remote Desktop, Active Directory) or on-premises SharePoint and SQL Server, schedule a maintenance window for them this very week.
- Check the Windows 11 version on each machine: those still on 24H2 Home or Pro stop receiving security patches.
If you don't have anyone to keep this up to date, our IT maintenance service includes the update review, remotely and with on-site support in Madrid and surrounding areas; if your business is in Valdemoro, you'll find the details in IT maintenance in Valdemoro. For a more complete diagnosis of your exposure, you can request a tailored audit.