During the October Patch Tuesday, Microsoft fixed more than 1400 security vulnerabilities in its own software. Never before has Microsoft patched so many vulnerabilities on a single patch day. One of the flaws was already being actively exploited before the patches were released, and Microsoft gives no details about the observed attacks.
Windows accounts for 1,100 of the problems. The actively exploited flaw sits in Windows Shell (CVE-2026-96951) and makes it possible to bypass Mark of the Web. This Windows security feature tags files downloaded from the internet, so that Windows shows an extra warning before a user opens them. Bypassing it removes that safety net.
Around one hundred of the vulnerabilities are rated critical, most of them in Microsoft Office, where they allow remote code execution, according to Microsoft. Exploitation is possible by getting a user to open a specially crafted file, but in many cases also via the Preview Pane, so the target does not have to open the file at all. Most of the other flaws let an attacker who already has access to a system elevate privileges and gain full control of it.
Dustin Childs of cybersecurity company ZDI says 59 of the vulnerabilities fixed this month are wormable. This means they can be exploited without user interaction and enable automated attacks by a computer worm. Childs also highlights a critical flaw in Microsoft Office SharePoint (CVE-2026-102866), which allows an unauthenticated attacker to log in as any user if they manage to obtain that user’s token, something that can be done in several ways.
The Patch Tuesday updates will be installed automatically on most systems. Given the size of this release and the active exploitation, it is wise to verify that your own systems, especially Windows, Office and SharePoint, have actually received the patches. Make sure your vulnerability and patch management process can handle large releases like this one.
Read msrc.microsoft.com article for more information.
