Microsoft patches record 1,413 flaws as one Windows bug is already under attack

Microsoft shipped its largest monthly security update of the year on Tuesday, patching 1,413 vulnerabilities across Windows, Office and its server products. One of the flaws is already being used in attacks, and the federal government's cyber watchdog has given agencies until Friday to fix it.

The flaw, cataloged as CVE-2026-96951, is a security-feature bypass in the Windows Shell that Microsoft says is being exploited. The Cybersecurity and Infrastructure Security Agency added it to its catalog of known exploited vulnerabilities the same day, describing it as a command-injection weakness that lets an unauthorized attacker bypass a security feature over a network. Federal civilian agencies have until October 16 to apply the fix.

The numbers

Microsoft's own tally, published in its October 2026 Security Updates release notes, breaks the 1,413 fixes down by product: 1,102 in Windows, 134 in Office, 61 across developer tools, 36 in SharePoint Server, 22 in SQL Server, 15 in Azure and smaller numbers elsewhere, spread across 176 distinct updates. That is well above September's release, which Microsoft's notes put at 999 CVEs, itself already a large month by recent standards.

Alongside the Windows Shell bug, Microsoft flagged a second notable flaw, CVE-2026-108398, a .NET Framework security-feature bypass that has been publicly disclosed but is not known to be under active attack. The release also republishes a Raw Image Extension remote-code-execution bug reported by Cisco Talos, a routine courtesy Microsoft extends to flaws found by outside researchers in its products.

The National Vulnerability Database rates the Windows Shell flaw 8.8 out of 10 on the severity scale, describing it as improper handling of special characters in a command that lets an attacker bypass a security feature over a network once a user takes some action, such as opening a file. That is a lower bar than a fully remote, no-interaction exploit, but well within reach of the kind of phishing lure that has delivered most mass Windows exploitation in recent years.

How the deadline came about

The three-day clock on the Windows Shell bug reflects a change CISA made earlier this year to how it manages patching deadlines for federal agencies. Under a binding directive the agency calls BOD 26-04, instead of ranking every flaw the same way once it is added to the known-exploited list, agencies now have to weigh exposure, confirmed exploitation, how easily an attack can be automated and how much control it hands an attacker, then patch accordingly, with the most dangerous combinations due inside days rather than weeks. The same directive is why a second bug disclosed this week, an authentication-bypass flaw in Ivanti's Connect Secure VPN software, carries an identical October 16 deadline. CISA added both vulnerabilities to its exploited-vulnerabilities list on the same day, meaning agencies running either product are working against the same window.

Microsoft used the same release to introduce a separate, more experimental idea for coping with the sheer volume of monthly fixes. In a blog post published alongside the update guide, the company grouped this month's CVEs into provisional "risk cohorts," clusters of vulnerabilities that raise a similar question for administrators, such as whether untrusted content can reach a particular component, even when the bugs themselves have different root causes or severity scores. Illustrative groupings in the post run well over a hundred CVEs apiece, covering areas such as Windows filesystems and storage and Office document and mail clients. Microsoft was careful to frame the exercise as a supplement, not a replacement, for checking each flaw on its own merits, and it is asking customers for feedback before deciding whether to formalize the idea.

"Cohorts do not replace careful review of high-severity or actively exploited vulnerabilities," Microsoft said in the post introducing the approach.

Who has to act, and by when

The binding deadline applies directly only to federal civilian executive-branch agencies, which make up a fraction of the organizations running Windows or Ivanti's VPN gear. But CISA has said it expects other government bodies, contractors and private operators of critical infrastructure to treat its known-exploited list the same way, and security teams well beyond Washington typically use the federal deadline as a proxy for urgency. For most large organizations, that means two unrelated pieces of their infrastructure, a Windows feature and a remote-access VPN appliance, both need attention from already-stretched patching teams in the same 72-hour window, on top of absorbing a record-sized monthly release that touches nearly every Windows and Office installation in use.

Smaller businesses and consumers running standard Windows Update are not bound by the federal deadline, but they receive the same fix automatically, and the exploitation already under way means delay carries real risk regardless of the October 16 date.

What happens next

This month's groupings should be read as a trial rather than a permanent fixture of future Patch Tuesdays, and the Security Update Guide itself does not yet display them. CISA, meanwhile, is expected to keep applying its risk-based framework to whatever comes out of Ivanti's and Microsoft's ongoing investigations into both flaws; neither company has said whether the attacks exploiting them are linked or came from the same source, or how many organizations have already been compromised. The Ivanti flaw, rated 8.6 in severity and affecting Connect Secure versions before 25.1.3.0, is the kind of edge-network appliance bug that typically sits outside the perimeter most security teams watch most closely, which is part of why remote-access VPN software has repeatedly drawn attacker interest.

The immediate test is simpler than either company's longer-term plans: whether federal agencies, and the much larger population of organizations that take cues from CISA's deadlines, can apply two unrelated emergency fixes, one inside Windows and one inside a VPN gateway, before Friday arrives. Microsoft's broader October release, patched automatically for most Windows and Office users through normal update channels, will take considerably longer to roll out fully across the much larger population of machines that are not on a forced federal timetable.