Microsoft Patches 1,413 Vulnerabilities, Including an Actively Exploited Windows Zero-Day
Summary
Microsoft's October Patch Tuesday addressed 1,413 vulnerabilities, including an actively exploited Windows Shell zero-day. The update also introduced risk cohorts to help customers prioritize vulnerabilities.
Key points
- The update addressed 1,413 vulnerabilities, exceeding Microsoft's previous annual record of 1,261 CVEs set in 2020.
- One actively exploited zero-day, CVE-2026-96951, affects Windows Shell and allows unauthorized attackers to bypass a security feature.
- The update included 1,102 Windows vulnerabilities, 134 in Office, 61 in developer tools, and 36 in SharePoint Server.
- Microsoft introduced risk cohorts to group vulnerabilities that may require similar customer assessments and prioritization.
- A TrendAI Zero Day Initiative representative said the volume of vulnerability discovery is scaling faster than exploitation and advised prioritizing based on exploitability.
Article Details
- Event Type
- Microsoft Patch Tuesday vulnerability disclosure and security update, including one actively exploited zero-day.
- Impact
- Microsoft disclosed 1,413 vulnerabilities across its products and services. The actively exploited zero-day, CVE-2026-96951, affects Windows Shell and allows unauthorized attackers to bypass a security feature. The update also addresses vulnerabilities in Windows, Office, developer tools, and SharePoint Server.
CVE
People
Vendors
Products
Microsoft WindowsMicrosoft disclosed one actively exploited zero-day affecting Windows Shell — CVE-2026-96951 — that allows unauthorized attackers to bypass a security feature.OfficeThe update also included 134 vulnerabilities in Office, 61 in various developer tools and 36 in SharePoint Server.SharePoint ServerThe update also included 134 vulnerabilities in Office, 61 in various developer tools and 36 in SharePoint Server.Windows ShellMicrosoft disclosed one actively exploited zero-day affecting Windows Shell — CVE-2026-96951 — that allows unauthorized attackers to bypass a security feature.