Microsoft patches 1,413 flaws, including exploited zero-day

Microsoft disclosed 1,413 vulnerabilities in its October Patch Tuesday update, including 1,102 Windows flaws, according to security firm Rapid7.

The release is larger than September's and includes one vulnerability that Microsoft said is already being exploited.

Rapid7 highlighted CVE-2026-96951, a zero-day flaw in the Windows Shell. The vulnerability enables a Mark of the Web bypass, meaning Windows may fail to display its usual warning that a file or other content could be unsafe.

Exploitation requires a user to open a specially crafted malicious file or visit an attacker-controlled site, the analysis said. The vulnerability also affected Outlook.com, though that service had already been patched in an earlier build.

Adam Barnett, Lead Software Engineer at Rapid7, said the flaw marks the second exploited zero-day in the Windows Shell this year. "Once again, the immediate prize for an attacker is a Mark of the Web (MOTW) bypass. What this means is that Windows won't provide the user with a dialog explaining that Windows protected their PC, because in this case, it didn't," Barnett said.

Rapid7 also identified two publicly disclosed vulnerabilities in this month's release. One, CVE-2026-108398, affects the .NET Framework and is described as a security feature bypass.

An attacker would need an existing foothold on a target system to exploit the issue, according to Rapid7. The method involves registering a malicious .NET assembly to be loaded by a protected process, potentially bypassing Windows Defender Application Control, now called App Control for Business.

Outlook focus

Another concern is a cluster of Outlook remote code execution flaws linked to the preview pane. Microsoft issued fixes for five separate Outlook vulnerabilities that could be triggered through the reading pane, Rapid7 said.

The flaws are CVE-2026-70242, CVE-2026-97749, CVE-2026-97016, CVE-2026-88156, and CVE-2026-70291. Simply scrolling past an email in the Outlook reading pane could be enough to trigger exploitation, the analysis said, and in some cases Outlook may display a preview without user interaction.

Barnett said the growing volume of disclosures can make serious flaws less visible. "The sheer volume of vulnerabilities in recent Patch Tuesday releases can easily include several examples of potentially concerning vulnerabilities, each of which might have been more remarkable in its own right back when volumes were lower," he said.

Rapid7 also raised concerns about Microsoft's handling of recent Edge browser security updates. Several entries in the Edge release notes refer to new versions that incorporate Chromium fixes without listing the vulnerabilities addressed.

At the time of the analysis, the Security Update Guide showed no Edge vulnerabilities fixed during the opening part of the month, while the release notes said CVE details would be added later. That left defenders without a clear way to identify which recent browser vulnerabilities had been addressed, Rapid7 said.

Lifecycle changes

The October release also coincides with several product support milestones across Microsoft's software portfolio. Rapid7 noted that Windows 11 24H2 Home and Pro had reached end of servicing, while Windows Server 2022 had moved into extended support.

Under extended support, critical security updates continue, but no further feature development is planned. Rapid7 also said the third and final year of paid Extended Security Updates for Windows Server 2012 and Windows Server 2012 R2 had expired.

That leaves organisations still relying on those server versions under increasing pressure to migrate. Rapid7 noted that Windows Server 2012 does not receive a patch for the exploited Windows Shell issue, although Server 2012 R2 does.

Other products moving out of support include Office 2021, including its Long-Term Servicing Channel edition, and Exchange Server 2016 and Exchange Server 2019. Microsoft has indicated that future Exchange Server CVEs will no longer mention those unsupported versions, Rapid7 said, while warning that unsupported products may still remain vulnerable to new security issues.

The release also reflects a broader shift in vulnerability numbering. Barnett noted that this is only the second month in which Microsoft has published vulnerabilities with six-digit CVE numbers, a sign of the larger volume now moving through industry disclosure systems. "If any further indications were needed that vulnerability volumes are increasing industry-wide, this is only the second month that Microsoft has published vulnerabilities with six-digit CVE numbers, but these extra-large CVEs will seem unremarkable from now on," he said.