Microsoft Patches More Than 1,400 Security Flaws, Including an Exploited Zero-Day

Summary

Microsoft issued fixes for more than 1,400 vulnerabilities, including one exploited zero-day and at least 78 critical flaws. A .NET Framework security bypass had also been publicly disclosed before the updates.

Key points

The October 13 update batch fixes more than 1,400 vulnerabilities across Windows and other Microsoft software, surpassing the previous monthly record cited in the article.
One patched flaw, CVE-2026-96951, is an actively exploited Windows Shell security feature bypass affecting Windows 10, Windows 11, and some Windows Server versions.
At least 78 vulnerabilities are rated critical; most of those could let an attacker execute code on a vulnerable system.
CVE-2026-108398, a .NET Framework security feature bypass, was publicly disclosed before the update; Microsoft said there were no signs it had been exploited.
The article reports that Microsoft credited large language models with contributing to the high volume of vulnerability discoveries.
A security expert advised organizations to prioritize the 26 Microsoft vulnerabilities listed in CISA's Known Exploited Vulnerabilities catalog so far this year.

Article Details

Vulnerability Types: Security feature bypass
Severity: At least 78 vulnerabilities are rated critical; CVE-2026-96951 is described as a zero-day.
Affected Versions: Windows 10
Windows 11
Some Windows Server versions
Exploitation Status: active
Exploit Availability: unknown
Patch Status: available