Microsoft’s October 13 Patch Tuesday was the largest on record: 1,411 vulnerabilities, according to BleepingComputer’s count, which excludes 348 flaws fixed earlier in the month. Three were zero-days. Counts vary by outlet, so use your own tooling as the source of truth.
The zero-days
| CVE | Component | Type | Status |
|---|---|---|---|
| CVE-2026-96951 | Windows Shell | Security feature bypass (Mark of the Web) | Actively exploited |
| CVE-2026-108398 | .NET Framework | Security feature bypass (WDAC) | Publicly disclosed |
| CVE-2026-92707 | MessagePack-CSharp | Denial of service | Publicly disclosed |
The .NET bypass could let an attacker run code that Windows Defender Application Control should block. It was reported by James Forshaw of Google Project Zero. No details on how the Windows Shell flaw is being exploited have been shared.
The numbers
- Critical: 70 by BleepingComputer’s count: 57 remote code execution, 11 elevation of privilege and 2 spoofing. Other outlets report different totals, such as 80.
- Biggest groups: .NET, Active Directory Federation Services, Azure services and Mariner. Many Mariner flaws are in third-party components such as Apache Thrift and GnuTLS, which inflates the headline total.
- Also fixed: a critical Linux kernel elevation of privilege flaw, CVE-2026-62840.
Risk cohorts: new, and experimental
Microsoft introduced “risk cohorts” this month: 15 groups of related flaws to help with prioritisation, for example 136 flaws in Windows filesystems, storage and backup, and 135 in Office and mail clients. Microsoft says the method is experimental, does not show which flaws are most dangerous, and does not replace its existing guidance. It is useful for planning test rings by area, not for deciding what is urgent.
Where to be skeptical
A record count does not mean a record risk. Many of these flaws are in components most organisations do not run. The real work is the handful that are exploited or exposed on your systems. Do not let the headline number push you into skipping testing.
A practical order
- Patch the actively exploited flaw first (CVE-2026-96951) on user workstations. Until then, treat files from the internet and email with extra caution, since Mark of the Web warnings may not appear.
- Check WDAC and .NET. If you rely on application control, prioritise the .NET fix and review your policies.
- Patch internet-facing and identity servers, including AD FS, before general server rings.
- Use cohorts to organise testing: filesystem and backup changes and Office client changes deserve their own pilot groups.
- Remember lifecycle. Windows 11 24H2 Home and Pro stopped receiving updates with this release. See our note on moving to 25H2.
